Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541692
MD5:	31c4dc3c764474d495340d6aa688e639
SHA1:	208a17ba8dbf1cab0a603b2a175e115c1e5d6a72
SHA256:	6a159a3587508bfb504d2a7cf6fd993361316102d416182b10d5516232383d09
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2168 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 31C4DC3C764474D495340D6AA688E639)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["mobbipenju.store", "spirittunek.store", "dissapoiznw.store", "studennotediw.store", "clearancek.site", "eaglepawnoy.store", "licendfilteo.site", "bathdoomgaz.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.632721+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	57265	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.396103+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	55266	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.475022+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	51848	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.454165+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	51966	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.695357+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	55038	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.438410+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	59660	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.648981+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	56553	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:10.497719+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	64533	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T02:18:12.338781+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49711	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.2168.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["mobbipenju.store", "spirittunek.store", "dissapoiznw.store", "studennotediw.store", "clearancek.site", "eaglepawnoy.store", "licendfilteo.site", "bathdoomgaz.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: bathdoomgaz.store	Virustotal: Detection: 20%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 21%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 20%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B050FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00ACD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00ACD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00B063B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00B099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00B0695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00ACFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00AD0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00B06094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00AD6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_00AFF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00AC1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00B04040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00AED1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00AD42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00AE2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00AE2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_00ACA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00B064B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AEE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00ADB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00AEC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00B01440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00ADD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00AC8590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00B07520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00AD6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00AE9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AEE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00AFB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AED7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00B067EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00B07710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B05700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00AE28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00AC49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00B03920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00ADD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AD1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AD1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00B04A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00AC5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00AF0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00AD1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00AD3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00ADDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00ADDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00B09B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AEAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00AEAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B09CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00B09CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00AECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00AECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00AFFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00AE7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00AEEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B08D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AEDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00AEFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00AC6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00AD6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00ACBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00AD1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00AD4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00AE7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AE5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00AEAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00AD6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00B05FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00B07FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B07FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00ADFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00AC8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AE9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AFFF70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:56553 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:51848 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:51966 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:59660 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:55266 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:57265 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:55038 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:64533 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49711 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: bathdoomgaz.store

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000002.2211125821.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.s
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8d
Source: file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.st
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=b
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/sticker
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/apii
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/5
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/M
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api5
Source: file.exe, 00000000.00000003.2192560687.0000000001318000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211246324.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apip
Source: file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apiVn
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.2211125821.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000002.2211125821.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900jA5Y
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/765611997243319005n
Source: file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD0228	0_2_00AD0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD	0_2_00C9A0FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0A0D0	0_2_00B0A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD2030	0_2_00AD2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC1000	0_2_00AC1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9F01D	0_2_00C9F01D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B04040	0_2_00B04040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACE1A0	0_2_00ACE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC71F0	0_2_00AC71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC5160	0_2_00AC5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC12F7	0_2_00AC12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF82D0	0_2_00AF82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF12D0	0_2_00AF12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACB3A0	0_2_00ACB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC13A3	0_2_00AC13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF23E0	0_2_00AF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8E35A	0_2_00C8E35A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACA300	0_2_00ACA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD4487	0_2_00AD4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD049B	0_2_00AD049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF64F0	0_2_00AF64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C934A1	0_2_00C934A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C984B9	0_2_00C984B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEC470	0_2_00AEC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC35B0	0_2_00AC35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC8590	0_2_00AC8590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADC5F0	0_2_00ADC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9D5BF	0_2_00C9D5BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B086F0	0_2_00B086F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFF620	0_2_00AFF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B08652	0_2_00B08652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC164F	0_2_00AC164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFE8A0	0_2_00AFE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFB8C0	0_2_00AFB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9187E	0_2_00C9187E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF1860	0_2_00AF1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2A81E	0_2_00C2A81E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACA850	0_2_00ACA850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7F9CC	0_2_00C7F9CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C969C4	0_2_00C969C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B089A0	0_2_00B089A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE098B	0_2_00AE098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B07AB0	0_2_00B07AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B08A80	0_2_00B08A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B04A40	0_2_00B04A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7BF0	0_2_00AC7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9BB40	0_2_00C9BB40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADDB6F	0_2_00ADDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B06CBF	0_2_00B06CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C90C90	0_2_00C90C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AECCD0	0_2_00AECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B08C02	0_2_00B08C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8ADF7	0_2_00C8ADF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEDD29	0_2_00AEDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEFD10	0_2_00AEFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE8D62	0_2_00AE8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD6EBF	0_2_00AD6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACBEB0	0_2_00ACBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD4E2A	0_2_00AD4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B08E70	0_2_00B08E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEAE57	0_2_00AEAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C94F86	0_2_00C94F86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C87FAE	0_2_00C87FAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B07FC0	0_2_00B07FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC8FD0	0_2_00AC8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACAF10	0_2_00ACAF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00ACCAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00ADD300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9995552289603961

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF8220 CoCreateInstance,

0_2_00AF8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 2996224 > 1048576

Source: file.exe

Static PE information: Raw size of tgoperjb is bigger than: 0x100000 < 0x2b2200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ac0000.0.unpack :EW;.rsrc :W;.idata :W;tgoperjb:EW;kunybgfa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;tgoperjb:EW;kunybgfa:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2ded73 should be: 0x2de2e6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: tgoperjb
Source: file.exe	Static PE information: section name: kunybgfa
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 2A15691Eh; mov dword ptr [esp], esp	0_2_00C9A119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 33163F4Dh; mov dword ptr [esp], ebp	0_2_00C9A126
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebp; mov dword ptr [esp], edx	0_2_00C9A1A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push esi; mov dword ptr [esp], ebx	0_2_00C9A218
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 6046E0FBh; mov dword ptr [esp], eax	0_2_00C9A2EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebx; mov dword ptr [esp], edi	0_2_00C9A313
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebx; mov dword ptr [esp], ecx	0_2_00C9A3C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebx; mov dword ptr [esp], edi	0_2_00C9A456
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 163A9742h; mov dword ptr [esp], edi	0_2_00C9A46B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 4BD30412h; mov dword ptr [esp], ebp	0_2_00C9A488
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push edi; mov dword ptr [esp], ebp	0_2_00C9A4AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 0A0B65BEh; mov dword ptr [esp], edx	0_2_00C9A5BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 3D5EAAA2h; mov dword ptr [esp], ecx	0_2_00C9A61E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push eax; mov dword ptr [esp], edi	0_2_00C9A672
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebp; mov dword ptr [esp], 77F7A9A0h	0_2_00C9A6F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 3B452823h; mov dword ptr [esp], eax	0_2_00C9A804
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebp; mov dword ptr [esp], ecx	0_2_00C9A815
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push eax; mov dword ptr [esp], 72C70DE9h	0_2_00C9A833
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 24C66CD3h; mov dword ptr [esp], edx	0_2_00C9A85F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 6528CA58h; mov dword ptr [esp], eax	0_2_00C9A872
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push edi; mov dword ptr [esp], edx	0_2_00C9A8AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ecx; mov dword ptr [esp], 08F071B0h	0_2_00C9A976
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ecx; mov dword ptr [esp], esi	0_2_00C9AA63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push edi; mov dword ptr [esp], esi	0_2_00C9AB01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebp; mov dword ptr [esp], 3FF76300h	0_2_00C9AB64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebx; mov dword ptr [esp], 789CA874h	0_2_00C9ABA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 68F747C2h; mov dword ptr [esp], edx	0_2_00C9AC7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push edi; mov dword ptr [esp], ecx	0_2_00C9ACBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebx; mov dword ptr [esp], ecx	0_2_00C9AD0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push ebp; mov dword ptr [esp], ebx	0_2_00C9AD57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A0FD push 675C1587h; mov dword ptr [esp], edi	0_2_00C9AE22

Source: file.exe

Static PE information: section name: entropy: 7.977275252454008

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B243DB second address: B23C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B6Dh 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F6D58FF7B77h 0x00000010 nop 0x00000011 jmp 00007F6D58FF7B75h 0x00000016 push dword ptr [ebp+122D15B1h] 0x0000001c jmp 00007F6D58FF7B6Bh 0x00000021 call dword ptr [ebp+122D1CF9h] 0x00000027 pushad 0x00000028 sub dword ptr [ebp+122D1CB6h], eax 0x0000002e xor eax, eax 0x00000030 jno 00007F6D58FF7B67h 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a jmp 00007F6D58FF7B76h 0x0000003f add dword ptr [ebp+122D1CB6h], edi 0x00000045 mov dword ptr [ebp+122D2CB0h], eax 0x0000004b mov dword ptr [ebp+122D288Eh], esi 0x00000051 mov esi, 0000003Ch 0x00000056 clc 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b pushad 0x0000005c mov bx, si 0x0000005f mov ecx, ebx 0x00000061 popad 0x00000062 lodsw 0x00000064 mov dword ptr [ebp+122D2B55h], ecx 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e jmp 00007F6D58FF7B76h 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 jnl 00007F6D58FF7B6Ch 0x0000007e mov dx, 616Bh 0x00000082 popad 0x00000083 nop 0x00000084 pushad 0x00000085 jmp 00007F6D58FF7B6Bh 0x0000008a push eax 0x0000008b jmp 00007F6D58FF7B6Fh 0x00000090 pop eax 0x00000091 popad 0x00000092 push eax 0x00000093 push eax 0x00000094 push edx 0x00000095 jmp 00007F6D58FF7B72h 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5F93 second address: CA5FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6D592C716Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5FA6 second address: CA5FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4EA3 second address: CA4EBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7172h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA51ED second address: CA51F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA51F3 second address: CA520D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6D592C7172h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA53A2 second address: CA53BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6D58FF7B70h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8CE5 second address: CA8CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8CEC second address: CA8D27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jc 00007F6D58FF7B68h 0x00000014 push edi 0x00000015 jns 00007F6D58FF7B66h 0x0000001b pop edi 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 jmp 00007F6D58FF7B6Ah 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8DAA second address: CA8DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8DAE second address: CA8E13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6D58FF7B70h 0x0000000e popad 0x0000000f push eax 0x00000010 jc 00007F6D58FF7B75h 0x00000016 jmp 00007F6D58FF7B6Fh 0x0000001b nop 0x0000001c push ecx 0x0000001d stc 0x0000001e pop edx 0x0000001f mov dword ptr [ebp+122D2924h], ecx 0x00000025 push 00000000h 0x00000027 or dx, 7DCBh 0x0000002c and ecx, 429E64A2h 0x00000032 push 9EF991F7h 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a jg 00007F6D58FF7B66h 0x00000040 pop edi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8E13 second address: CA8E5C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6D592C7168h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 61066E89h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F6D592C7168h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b push 00000003h 0x0000002d clc 0x0000002e push 00000000h 0x00000030 mov edi, 010B3392h 0x00000035 push 00000003h 0x00000037 sbb cx, 8992h 0x0000003c push CCD0FD21h 0x00000041 pushad 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8E5C second address: CA8EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jnp 00007F6D58FF7B66h 0x0000000e pop esi 0x0000000f popad 0x00000010 xor dword ptr [esp], 0CD0FD21h 0x00000017 jns 00007F6D58FF7B6Ch 0x0000001d sub esi, 42EF8F1Ah 0x00000023 lea ebx, dword ptr [ebp+12458BF9h] 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F6D58FF7B68h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 xor ecx, dword ptr [ebp+122D2E3Ch] 0x00000049 xchg eax, ebx 0x0000004a push edx 0x0000004b jnc 00007F6D58FF7B68h 0x00000051 pop edx 0x00000052 push eax 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 jg 00007F6D58FF7B66h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA91D7 second address: CA91DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAE2C second address: CBAE32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7701 second address: CC7705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7858 second address: CC7867 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6D58FF7B6Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7B48 second address: CC7B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7B4C second address: CC7B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F6D58FF7B72h 0x0000000e jmp 00007F6D58FF7B6Ah 0x00000013 push esi 0x00000014 pop esi 0x00000015 jne 00007F6D58FF7B68h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6D58FF7B71h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7B83 second address: CC7B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7B87 second address: CC7B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8647 second address: CC864B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC864B second address: CC8688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push ecx 0x0000000a jbe 00007F6D58FF7B72h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6D58FF7B79h 0x00000017 jo 00007F6D58FF7B66h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92FE7 second address: C92FFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F6D592C716Eh 0x0000000c jnc 00007F6D592C7166h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC87D3 second address: CC87DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6D58FF7B66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC87DD second address: CC87EC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6D592C7166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8E76 second address: CC8E7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8E7B second address: CC8EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6D592C7166h 0x0000000a jnp 00007F6D592C7166h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 jo 00007F6D592C716Eh 0x00000019 jne 00007F6D592C7166h 0x0000001f pushad 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F6D592C716Dh 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9011 second address: CC9046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F6D58FF7B77h 0x0000000c jmp 00007F6D58FF7B6Dh 0x00000011 jg 00007F6D58FF7B6Eh 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC340 second address: CCC347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB1B3 second address: CCB1B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB1B7 second address: CCB1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6D592C7174h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC9D1 second address: CCCA1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F6D58FF7B66h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6D58FF7B6Dh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F6D58FF7B74h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6D58FF7B78h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCA1F second address: CCCA54 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6D592C7175h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6D592C7175h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCBBA second address: CCCBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCBBE second address: CCCBD0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6D592C7166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F6D592C7166h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCBD0 second address: CCCBFC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6D58FF7B76h 0x00000014 ja 00007F6D58FF7B66h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCBFC second address: CCCC16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6D592C7176h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88C8E second address: C88C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88C94 second address: C88C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88C98 second address: C88C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88C9C second address: C88CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88CA2 second address: C88CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F6D58FF7B6Eh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88CBA second address: C88CC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88CC3 second address: C88CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e ja 00007F6D58FF7B66h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD51FF second address: CD520D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jno 00007F6D592C7166h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD56AA second address: CD56DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F6D58FF7B66h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c jmp 00007F6D58FF7B78h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jg 00007F6D58FF7B66h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD56DB second address: CD56E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD56E1 second address: CD56E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD56E8 second address: CD56F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD56F1 second address: CD56FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD59E6 second address: CD59F2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6D592C716Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6708 second address: CD671D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD671D second address: CD6722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD696D second address: CD6977 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6977 second address: CD697B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6BC1 second address: CD6BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6BC7 second address: CD6BDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD74CF second address: CD74D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD77B8 second address: CD7809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F6D592C7168h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 jmp 00007F6D592C716Eh 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6D592C7173h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7CED second address: CD7CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD967E second address: CD9682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9F5B second address: CD9F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6D58FF7B66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9F66 second address: CD9F7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F6D592C7166h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9F7B second address: CD9F81 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCE7C second address: CDCEDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C716Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b jbe 00007F6D592C7169h 0x00000011 xor ah, 00000032h 0x00000014 jmp 00007F6D592C716Ah 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d clc 0x0000001e pop esi 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F6D592C7168h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b movzx edi, cx 0x0000003e push eax 0x0000003f pushad 0x00000040 jnp 00007F6D592C716Ch 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCEDB second address: CDCEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4F93 second address: CE4FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D592C716Bh 0x00000009 popad 0x0000000a pop edi 0x0000000b nop 0x0000000c add dword ptr [ebp+122D277Fh], edi 0x00000012 push 00000000h 0x00000014 jbe 00007F6D592C7172h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F6D592C7168h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D2D1Ch] 0x0000003c mov dword ptr [ebp+122D58C1h], ebx 0x00000042 xchg eax, esi 0x00000043 pushad 0x00000044 jne 00007F6D592C716Ch 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4FFE second address: CE500C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE00EE second address: CE00F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE11B4 second address: CE11B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE32D8 second address: CE32DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE500C second address: CE5010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE00F5 second address: CE010E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6D592C716Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5010 second address: CE501A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8287 second address: CE828E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE63A1 second address: CE63A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE63A5 second address: CE63A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE63A9 second address: CE63AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE63AF second address: CE63B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8A95 second address: CE8A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE63B4 second address: CE63D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F6D592C7176h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9985 second address: CE9989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE63D9 second address: CE63DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9989 second address: CE998F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE998F second address: CE9995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE64C0 second address: CE64E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6D58FF7B66h 0x0000000a popad 0x0000000b push edx 0x0000000c jng 00007F6D58FF7B66h 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 jg 00007F6D58FF7B74h 0x0000001b push eax 0x0000001c push edx 0x0000001d jno 00007F6D58FF7B66h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9995 second address: CE9A1D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F6D592C7168h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov dword ptr [ebp+12460A78h], ebx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F6D592C7168h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 push 00000000h 0x00000047 call 00007F6D592C7173h 0x0000004c call 00007F6D592C716Eh 0x00000051 mov edi, 6179BEA7h 0x00000056 pop edi 0x00000057 pop edi 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d pop ecx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED95E second address: CED96F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6D58FF7B6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA984 second address: CEA99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6D592C7174h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9B1F second address: CE9B25 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDBB9 second address: CEDBCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C716Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9B25 second address: CE9B2F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6D58FF7B6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDBCC second address: CEDBE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007F6D592C7166h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 ja 00007F6D592C7166h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9BD9 second address: CE9BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6D58FF7B6Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0A62 second address: CF0A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFC00 second address: CEFC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0A68 second address: CF0A6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0A6D second address: CF0A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFC04 second address: CEFC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6D592C716Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jnl 00007F6D592C7166h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3054 second address: CF305E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9EB4 second address: CF9EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6D592C7166h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95CC second address: CF95EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B76h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95EB second address: CF95EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95EF second address: CF95F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95F3 second address: CF95F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9912 second address: CF9916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9916 second address: CF9952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6D592C7173h 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007F6D592C7176h 0x00000015 jc 00007F6D592C7166h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9A97 second address: CF9AA5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE672 second address: CFE676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE676 second address: CFE67C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04511 second address: D04516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8A88B second address: C8A891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0315A second address: D03180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007F6D592C7181h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03180 second address: D03188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D038D7 second address: D038DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D038DC second address: D038E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D038E7 second address: D038ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D038ED second address: D038F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03A38 second address: D03A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6D592C7166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03BB0 second address: D03BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03D1B second address: D03D25 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6D592C7166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03D25 second address: D03D31 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6D58FF7B6Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03E9C second address: D03EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F6D592C716Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03EB3 second address: D03EC3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F6D58FF7B66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03EC3 second address: D03EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04081 second address: D04087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04087 second address: D0408D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0408D second address: D040A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0421B second address: D0421F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04377 second address: D0437B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0437B second address: D04381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04381 second address: D0438B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99BC5 second address: C99BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99BC9 second address: C99C09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jp 00007F6D58FF7B98h 0x00000010 push ecx 0x00000011 jmp 00007F6D58FF7B6Ch 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6D58FF7B6Bh 0x0000001e jmp 00007F6D58FF7B6Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99C09 second address: C99C0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AAE4 second address: D0AB02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6D58FF7B72h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AB02 second address: D0AB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F6D592C7175h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AB22 second address: D0AB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE51 second address: D0CE55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE55 second address: D0CE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6D58FF7B6Eh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnp 00007F6D58FF7B66h 0x00000014 jmp 00007F6D58FF7B72h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE84 second address: D0CE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE88 second address: D0CE8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE8C second address: D0CE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE92 second address: D0CE97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12861 second address: D12865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D115DB second address: D1160F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B70h 0x00000009 jmp 00007F6D58FF7B6Dh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6D58FF7B6Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1160F second address: D11613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11613 second address: D1161D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D125AD second address: D125CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D125CD second address: D125EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B6Ah 0x00000009 pop esi 0x0000000a pushad 0x0000000b jne 00007F6D58FF7B66h 0x00000011 jp 00007F6D58FF7B66h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17DDD second address: D17DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17DE1 second address: D17DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17DE5 second address: D17DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6D592C716Fh 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17DFF second address: D17E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F6D58FF7B76h 0x0000000d ja 00007F6D58FF7B66h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17E25 second address: D17E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F6D592C7166h 0x0000000c jo 00007F6D592C7166h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17E39 second address: D17E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180CC second address: D180D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6D592C7166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180D8 second address: D180E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180E0 second address: D180E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180E4 second address: D18107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6D58FF7B6Dh 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18107 second address: D18113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6D592C7166h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D183F7 second address: D1841F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F6D58FF7B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6D58FF7B79h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18561 second address: D18567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D7B second address: D18D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D81 second address: D18D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D86 second address: D18D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F6D58FF7B66h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D93 second address: D18D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D99 second address: D18DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D191D0 second address: D191D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CEFF second address: D1CF1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6D58FF7B73h 0x00000009 jnc 00007F6D58FF7B66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CF1C second address: D1CF3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7176h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CF3B second address: D1CF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F6D58FF7B6Bh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CF55 second address: D1CF87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6D592C716Eh 0x0000000b popad 0x0000000c pushad 0x0000000d jnc 00007F6D592C7166h 0x00000013 jmp 00007F6D592C7174h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CF87 second address: D1CF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE54D second address: CDE563 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C716Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE563 second address: CDE5FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 25C27A4Bh 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F6D58FF7B68h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov dword ptr [ebp+124835D6h], edx 0x0000002e call 00007F6D58FF7B69h 0x00000033 pushad 0x00000034 pushad 0x00000035 jp 00007F6D58FF7B66h 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e jmp 00007F6D58FF7B70h 0x00000043 popad 0x00000044 push eax 0x00000045 push ecx 0x00000046 jnp 00007F6D58FF7B75h 0x0000004c pop ecx 0x0000004d mov eax, dword ptr [esp+04h] 0x00000051 push ecx 0x00000052 jp 00007F6D58FF7B68h 0x00000058 pushad 0x00000059 popad 0x0000005a pop ecx 0x0000005b mov eax, dword ptr [eax] 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F6D58FF7B73h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE5FD second address: CDE603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE603 second address: CDE608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE77B second address: CDE77F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE85D second address: CDE896 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jg 00007F6D58FF7B6Ah 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F6D58FF7B77h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push esi 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE896 second address: CDE8A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE8A7 second address: CDE8B5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEE30 second address: CDEE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEFA9 second address: CDEFAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEFAD second address: CDEFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEFBA second address: CDEFBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEFBE second address: CDEFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF226 second address: CDF23E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jg 00007F6D58FF7B66h 0x00000011 js 00007F6D58FF7B66h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF23E second address: CDF270 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F6D592C7166h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 ja 00007F6D592C7174h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6D592C716Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF358 second address: CDF3C2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6D58FF7B6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6D58FF7B6Bh 0x00000011 pop edx 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F6D58FF7B68h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d pushad 0x0000002e jmp 00007F6D58FF7B6Eh 0x00000033 xor dword ptr [ebp+122D2557h], eax 0x00000039 popad 0x0000003a lea eax, dword ptr [ebp+1248DC44h] 0x00000040 mov dword ptr [ebp+1247F6A1h], ecx 0x00000046 nop 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushad 0x0000004b popad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF3C2 second address: CDF3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF3C7 second address: CDF3E0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6D58FF7B68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnc 00007F6D58FF7B66h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF3E0 second address: CDF3E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF3E5 second address: CBEF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor dh, FFFFFF82h 0x0000000d call dword ptr [ebp+122D289Dh] 0x00000013 jo 00007F6D58FF7B7Fh 0x00000019 pushad 0x0000001a jnc 00007F6D58FF7B66h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D1BE second address: D1D1CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F6D592C7166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D1CA second address: D1D1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6D58FF7B66h 0x0000000a jp 00007F6D58FF7B66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D328 second address: D1D332 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6D592C7166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D8DB second address: D1D8E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D8E0 second address: D1D90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F6D592C716Fh 0x0000000b jmp 00007F6D592C7170h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D90C second address: D1D910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DA74 second address: D1DA85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DA85 second address: D1DA89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DA89 second address: D1DAA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7174h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20677 second address: D2067B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D201C8 second address: D20220 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C716Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6D592C7170h 0x0000000e jmp 00007F6D592C7177h 0x00000013 popad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6D592C7175h 0x0000001c jnl 00007F6D592C7166h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20220 second address: D20224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2036F second address: D2038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F6D592C7170h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2038A second address: D2038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2038E second address: D20394 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D237E8 second address: D23810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F6D58FF7B66h 0x0000000d jmp 00007F6D58FF7B78h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23810 second address: D2381B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F6D592C7166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2381B second address: D23838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6D58FF7B73h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23838 second address: D2385C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6D592C7177h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2385C second address: D23862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C913C3 second address: C913D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6D592C716Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23142 second address: D23147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28A6F second address: D28A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28A74 second address: D28A8A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push edx 0x0000000f jg 00007F6D58FF7B66h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DD8D second address: C8DD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F6D592C7166h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DD9B second address: C8DDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B6Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27CBC second address: D27CCE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6D592C716Ch 0x00000008 jns 00007F6D592C7166h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27CCE second address: D27CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27E21 second address: D27E32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F6D592C7166h 0x0000000b pop edi 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27FDE second address: D27FF1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6D58FF7B6Eh 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28139 second address: D2813D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2813D second address: D28145 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28145 second address: D2814A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2814A second address: D28155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28155 second address: D28159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28159 second address: D2815F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D282A3 second address: D282C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6D592C7166h 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push edx 0x00000010 jmp 00007F6D592C7175h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2844F second address: D2848E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jnc 00007F6D58FF7B92h 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2848E second address: D2849D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D592C716Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2849D second address: D284CA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F6D58FF7B68h 0x00000010 pushad 0x00000011 jmp 00007F6D58FF7B78h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA4B second address: D2EA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D29C second address: D2D2A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D2A1 second address: D2D2C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D879 second address: D2D894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D894 second address: D2D89E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6D592C7166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEC61 second address: CDEC6B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEC6B second address: CDEC84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F6D592C7166h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jl 00007F6D592C7174h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEC84 second address: CDECFA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F6D58FF7B68h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 or di, 527Fh 0x0000002a pushad 0x0000002b or edx, dword ptr [ebp+122D2BF0h] 0x00000031 popad 0x00000032 mov ebx, dword ptr [ebp+1248DC83h] 0x00000038 clc 0x00000039 add eax, ebx 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007F6D58FF7B68h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000017h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 movsx ecx, bx 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F6D58FF7B6Dh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DCDB second address: D2DCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6D592C7166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DCE5 second address: D2DCFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B72h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DCFB second address: D2DD04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DD04 second address: D2DD0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32189 second address: D3219B instructions: 0x00000000 rdtsc 0x00000002 je 00007F6D592C7166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3219B second address: D3219F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32317 second address: D32366 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C716Dh 0x00000007 jmp 00007F6D592C7178h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jne 00007F6D592C7166h 0x00000015 jmp 00007F6D592C7177h 0x0000001a jc 00007F6D592C7166h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32366 second address: D32374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F6D58FF7B66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32374 second address: D3238E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6D592C716Ch 0x0000000b je 00007F6D592C716Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D327D5 second address: D327D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D327D9 second address: D327DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38553 second address: D38559 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38559 second address: D3855F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3855F second address: D38580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6D58FF7B70h 0x00000008 jnp 00007F6D58FF7B66h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D386BD second address: D386C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38AE3 second address: D38AE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38AE8 second address: D38B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F6D592C716Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6D592C7173h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38B14 second address: D38B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38B1F second address: D38B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38B26 second address: D38B5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6D58FF7B75h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F6D58FF7B75h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38EE2 second address: D38EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38EE6 second address: D38EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38EEC second address: D38EF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38EF1 second address: D38F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F6D58FF7B79h 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38F1A second address: D38F37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D397DA second address: D397F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B77h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39A9B second address: D39AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A311 second address: D3A315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A315 second address: D3A31F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A31F second address: D3A323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D400A9 second address: D400AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D400AD second address: D400DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F6D58FF7B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F6D58FF7B77h 0x00000014 pop edi 0x00000015 pop edx 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jnl 00007F6D58FF7B66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D434AE second address: D434C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D592C7173h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D434C5 second address: D434CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4365B second address: D4365F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4365F second address: D43665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43925 second address: D43929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43929 second address: D43931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43931 second address: D43936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43C00 second address: D43C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F6D58FF7B71h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jmp 00007F6D58FF7B74h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 jmp 00007F6D58FF7B71h 0x00000025 jmp 00007F6D58FF7B6Ch 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43C59 second address: D43C72 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnc 00007F6D592C7166h 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6D592C716Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43E08 second address: D43E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6D58FF7B78h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43F87 second address: D43F91 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6D592C7166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43F91 second address: D43F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D440F5 second address: D44100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44100 second address: D44104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44104 second address: D44108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0CD second address: D4D0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0D3 second address: D4D0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0DB second address: D4D0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0E6 second address: D4D0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6D592C7166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0F0 second address: D4D0F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B909 second address: D4B90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B90D second address: D4B929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6D58FF7B6Ch 0x0000000c pop edi 0x0000000d push edi 0x0000000e jc 00007F6D58FF7B72h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B929 second address: D4B945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6D592C7166h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6D592C716Eh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B945 second address: D4B94B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BBA4 second address: D4BBAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BD22 second address: D4BD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEBD second address: D4BEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6D592C7166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEC8 second address: D4BEE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6D58FF7B6Ch 0x00000009 jmp 00007F6D58FF7B70h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEE8 second address: D4BEF3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C833 second address: D4C839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53F21 second address: D53F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53F27 second address: D53F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D58FF7B78h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53ABD second address: D53ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D592C7176h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53ADE second address: D53AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5559B second address: D555A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6D592C7166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D578F0 second address: D57904 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6D58FF7B6Ch 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57904 second address: D5790A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5790A second address: D5790E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5790E second address: D5792B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F6D592C716Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5792B second address: D57934 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D22 second address: D63D36 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F6D592C716Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D36 second address: D63D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68C78 second address: D68C93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7177h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68998 second address: D689B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6D58FF7B76h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D791F1 second address: D791F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8212A second address: D82141 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6D58FF7B6Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F6D58FF7B66h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82141 second address: D82147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82147 second address: D8214B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82537 second address: D8253D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8253D second address: D82542 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85652 second address: D85668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6D592C7170h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85668 second address: D8566D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8832E second address: D88332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88332 second address: D8835F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6D58FF7B74h 0x00000010 jc 00007F6D58FF7B66h 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8835F second address: D88365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97FA3 second address: D97FA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97FA9 second address: D97FB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6D592C7166h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97FB5 second address: D97FD1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F6D58FF7B6Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97FD1 second address: D97FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6D592C716Fh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97E51 second address: D97E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93D61 second address: D93D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93D6D second address: D93D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9651B second address: C9652B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F6D592C7166h 0x0000000a jne 00007F6D592C7166h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC5EA second address: DBC5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC5EE second address: DBC611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F6D592C7175h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC611 second address: DBC615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC615 second address: DBC61F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6D592C7166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC03A7 second address: DC03B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC03B2 second address: DC03B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC03B8 second address: DC03D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnl 00007F6D58FF7B7Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC03D7 second address: DC03FF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6D592C7174h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F6D592C7166h 0x00000013 jno 00007F6D592C7166h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC06C1 second address: DC06D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F6D58FF7B6Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0853 second address: DC0857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0857 second address: DC086B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D58FF7B6Ah 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC086B second address: DC086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC086F second address: DC0873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0873 second address: DC087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC087D second address: DC0887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6D58FF7B66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0B4A second address: DC0B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0B50 second address: DC0B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0F81 second address: DC0FA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7176h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0FA3 second address: DC0FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0FAC second address: DC0FC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6D592C7172h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC571D second address: DC573A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1EC7h], eax 0x0000000e push 00000004h 0x00000010 mov dh, EEh 0x00000012 push 49E77EB3h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC573A second address: DC573E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC573E second address: DC5748 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6D58FF7B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5A96 second address: DC5A9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC706B second address: DC7071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7071 second address: DC707F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6D592C7166h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290D89 second address: 5290D8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B23CEC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCADE1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D5CA54 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5088

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2210825197.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW V0
Source: file.exe, 00000000.00000002.2211125821.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001318000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211246324.0000000001318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B05BB0 LdrInitializeThunk,

0_2_00B05BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: mobbipenju.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store

Source: file.exe, file.exe, 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 1:5Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
bathdoomgaz.store	21%	Virustotal	Browse
spirittunek.store	22%	Virustotal	Browse
eaglepawnoy.store	21%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	true	21%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	true	21%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true		unknown
studennotediw.store	unknown	unknown	true		unknown
mobbipenju.store	unknown	unknown	true		unknown
sergei-esenin.com	unknown	unknown	false		unknown
clearancek.site	unknown	unknown	true		unknown
dissapoiznw.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
studennotediw.store	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
eaglepawnoy.store	true	unknown
bathdoomgaz.store	true	unknown
clearancek.site	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bathdoomgaz.store:443/api	file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://licendfilteo.site:443/apii	file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com:443/apiVn	file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/sticker	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apip	file.exe, 00000000.00000003.2192560687.0000000001318000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211246324.0000000001318000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/M	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.st	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8d	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=b	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/5	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900jA5Y	file.exe, 00000000.00000002.2211125821.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2210825197.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211360977.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/api5	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/765611997243319005n	file.exe, 00000000.00000003.2192560687.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211125821.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.2192810225.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2211288798.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000002.2211341731.000000000135A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.0000000001327000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192534115.0000000001363000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192560687.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2192709992.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541692
Start date and time:	2024-10-25 02:17:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:18:09	API Interceptor	1x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	http://toungeassociates-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	23.38.98.114
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	104.108.130.154
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	23.209.51.130
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	2.19.126.160
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://boulos-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	23.38.98.114

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Loader.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.523024589346763
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'996'224 bytes
MD5:	31c4dc3c764474d495340d6aa688e639
SHA1:	208a17ba8dbf1cab0a603b2a175e115c1e5d6a72
SHA256:	6a159a3587508bfb504d2a7cf6fd993361316102d416182b10d5516232383d09
SHA512:	8dc2ac5420864e3bd4462bae00a04b654fcd724adfe5927323fdc67676bf9b540203e7cdac2f298d0f3a6dcfdbea49d08cb7c4a0cb3070419508d051e7c14dc1
SSDEEP:	49152:QlMbLpD5gfQExCxXZO3qLN1vYzCeLjH5:qMdufrSdfvYzhLjH
TLSH:	A8D539D2B64A61CFE4AF12788527CD82999E43BD4F1149C3A86D64BB7DF3CC811B6C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f.............................@1...........@..........................p1.....s.-...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x714000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6D58CCB11Ah
setbe byte ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	a31f3846cb03835099b06b47171948d4	False	0.9995552289603961	data	7.977275252454008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tgoperjb	0x60000	0x2b3000	0x2b2200	4a81ecbe141f4e7a87467b981233fc51	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kunybgfa	0x313000	0x1000	0x400	8bf0f8b6c13bad6682561eb33c7639d1	False	0.748046875	data	5.925814228578625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x314000	0x3000	0x2200	e04027a18243348e42b39ff6d36beb56	False	0.06732536764705882	DOS executable (COM)	0.8195466241807353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T02:18:10.396103+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	55266	1.1.1.1	53	UDP
2024-10-25T02:18:10.438410+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	59660	1.1.1.1	53	UDP
2024-10-25T02:18:10.454165+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	51966	1.1.1.1	53	UDP
2024-10-25T02:18:10.475022+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	51848	1.1.1.1	53	UDP
2024-10-25T02:18:10.497719+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	64533	1.1.1.1	53	UDP
2024-10-25T02:18:10.632721+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	57265	1.1.1.1	53	UDP
2024-10-25T02:18:10.648981+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	56553	1.1.1.1	53	UDP
2024-10-25T02:18:10.695357+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	55038	1.1.1.1	53	UDP
2024-10-25T02:18:12.338781+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49711	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 02:18:10.827090979 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:10.827131987 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:10.827689886 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:10.841543913 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:10.841558933 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:11.696649075 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:11.696784973 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:11.699310064 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:11.699323893 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:11.699629068 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:11.751355886 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:11.752516985 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:11.795353889 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.338891029 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.338948965 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.338970900 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.339010954 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.339029074 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.339034081 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.339034081 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.339034081 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.339056969 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.339076996 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.339076996 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.339154005 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.456657887 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.456712961 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.456768036 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.456779003 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.456805944 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.456834078 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.456834078 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.456841946 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.456918001 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.457452059 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 02:18:12.457534075 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.458733082 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 02:18:12.458748102 CEST	443	49711	104.102.49.254	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 02:18:10.396102905 CEST	55266	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.405353069 CEST	53	55266	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.438410044 CEST	59660	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.447966099 CEST	53	59660	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.454164982 CEST	51966	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.469854116 CEST	53	51966	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.475022078 CEST	51848	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.484560966 CEST	53	51848	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.497719049 CEST	64533	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.507447958 CEST	53	64533	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.632720947 CEST	57265	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.642724991 CEST	53	57265	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.648981094 CEST	56553	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.667337894 CEST	53	56553	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.695357084 CEST	55038	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.704464912 CEST	53	55038	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:10.813594103 CEST	53545	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:10.822357893 CEST	53	53545	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:12.461442947 CEST	63967	53	192.168.2.6	1.1.1.1
Oct 25, 2024 02:18:12.470767975 CEST	53	63967	1.1.1.1	192.168.2.6
Oct 25, 2024 02:18:27.258740902 CEST	53	58688	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 02:18:10.396102905 CEST	192.168.2.6	1.1.1.1	0xbf6	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.438410044 CEST	192.168.2.6	1.1.1.1	0x61c8	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.454164982 CEST	192.168.2.6	1.1.1.1	0xbf4a	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.475022078 CEST	192.168.2.6	1.1.1.1	0xdb78	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.497719049 CEST	192.168.2.6	1.1.1.1	0xa2e6	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.632720947 CEST	192.168.2.6	1.1.1.1	0x25b6	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.648981094 CEST	192.168.2.6	1.1.1.1	0xedc5	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.695357084 CEST	192.168.2.6	1.1.1.1	0x725a	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.813594103 CEST	192.168.2.6	1.1.1.1	0x826b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:12.461442947 CEST	192.168.2.6	1.1.1.1	0xa76d	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 02:18:10.405353069 CEST	1.1.1.1	192.168.2.6	0xbf6	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.447966099 CEST	1.1.1.1	192.168.2.6	0x61c8	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.469854116 CEST	1.1.1.1	192.168.2.6	0xbf4a	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.484560966 CEST	1.1.1.1	192.168.2.6	0xdb78	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.507447958 CEST	1.1.1.1	192.168.2.6	0xa2e6	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.642724991 CEST	1.1.1.1	192.168.2.6	0x25b6	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.667337894 CEST	1.1.1.1	192.168.2.6	0xedc5	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.704464912 CEST	1.1.1.1	192.168.2.6	0x725a	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:10.822357893 CEST	1.1.1.1	192.168.2.6	0x826b	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:12.470767975 CEST	1.1.1.1	192.168.2.6	0xa76d	Name error (3)	sergei-esenin.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.102.49.254	443	2168	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 00:18:11 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-25 00:18:12 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 25 Oct 2024 00:18:12 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=ef58e941692ede8c23cc1bcc; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-25 00:18:12 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-25 00:18:12 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-25 00:18:12 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-25 00:18:12 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Target ID:	0
Start time:	20:18:07
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xac0000
File size:	2'996'224 bytes
MD5 hash:	31C4DC3C764474D495340D6AA688E639
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	57.8%
Total number of Nodes:	45
Total number of Limit Nodes:	5

Executed Functions

Function 00B050FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00B05182

Strings

@^, xrefs: 00B05120
<I$), xrefs: 00B05198
<I$), xrefs: 00B052E3

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: b88a970664c337e5424bda758e8aac7cbbbe0ad61acf9d232b7804f6c2602c39
Instruction ID: 924ab89eb752291dc3da2e521b3d47fabcd3950ba8159a02d6a48772b51ac2b8
Opcode Fuzzy Hash: b88a970664c337e5424bda758e8aac7cbbbe0ad61acf9d232b7804f6c2602c39
Instruction Fuzzy Hash: D121A1355083848FC300DF68E88176ABBF4AB5A300FA9882CE1C5E7391DB35DA15CF5A

Function 00ACFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 00AD000D
VY^_, xrefs: 00ACFDFF
t, xrefs: 00ACFCBE
V, xrefs: 00ACFEDC

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 5c41d9b41e5f25112e393e6c09f17271bc877fa9f7ba2c35a565e06173369dfe
Instruction ID: 91095eb6f12bc05ad98a7664fbd03d6089122e0cfea9f365aa3365c38f8201dc
Opcode Fuzzy Hash: 5c41d9b41e5f25112e393e6c09f17271bc877fa9f7ba2c35a565e06173369dfe
Instruction Fuzzy Hash: 25D165745083809BD311DF189594B5FBBF2ABA2B44F18892DF4DA8B352C336CD49DB92

Function 00ACD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00ACD2F1

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e9c25e489a8b54b9b6557578c226cee58539ae8e2c9ddda61e37e4fefb7c52f1
Instruction ID: 5253556429c097f05605ddf1a186653d262c00ae25e83b8df9aaedb831cfff1f
Opcode Fuzzy Hash: e9c25e489a8b54b9b6557578c226cee58539ae8e2c9ddda61e37e4fefb7c52f1
Instruction Fuzzy Hash: FA41447040D380ABC301BB69D684E2EFBF5AF92745F198C2CE5C49B252C33AD8149B67

Function 00B05BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00B0973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00B05BDE

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00B0695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00B069C5

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: abc7c47f0a9d0f9c81a6fc07788f829e98c7afcadff94e76bd712364ea807b20
Instruction ID: ef7d55ee53905ec59dfc0cb201344ac809d7e144b2a82407147fdffb63b1500e
Opcode Fuzzy Hash: abc7c47f0a9d0f9c81a6fc07788f829e98c7afcadff94e76bd712364ea807b20
Instruction Fuzzy Hash: EC31A9B1A083019FD718EF18C8A072BBBF2FF84344F48985CE5C6972A1E7349914CB56

Function 00AD049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ae07fa4a15ac3e36ad3abb660b226bbe1ae2a8f99f5e0ff6ced84d18e912f2
Instruction ID: a58b1d8a1d6595741b333407dfc6e533a0f828478eb6ccdd1ee0d78aef9accba
Opcode Fuzzy Hash: b8ae07fa4a15ac3e36ad3abb660b226bbe1ae2a8f99f5e0ff6ced84d18e912f2
Instruction Fuzzy Hash: CD915875200B01CFD724CF25E894B26B7F6FF89314F118A6DE8568BAA1DB31E815CB90

Function 00AD0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148b3669c9f21b9a0d9a3af82a0ad10957fc78f62c936a4676d22d6cbcfe4e59
Instruction ID: 760db5763e9386b0e8dcd9ee855fb7f9fc8c72843a1e2df81683a1d37bd0754b
Opcode Fuzzy Hash: 148b3669c9f21b9a0d9a3af82a0ad10957fc78f62c936a4676d22d6cbcfe4e59
Instruction Fuzzy Hash: ED715874200701DFE724CF21E894B66B7F6FF89315F10896DE9968BA62DB31A815CB60

Function 00B099D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f08aaaf8b9af22991f381d6e8a7ded1a59c14efe1d49dff5400c3a3621ea31
Instruction ID: d70b7248b7a334d480bfe6079d3fc8ebc18260270b97ee8ccae341a22625a1c3
Opcode Fuzzy Hash: 98f08aaaf8b9af22991f381d6e8a7ded1a59c14efe1d49dff5400c3a3621ea31
Instruction Fuzzy Hash: DD416F34208300ABD7249E15D991B2BBBE6EB85724F5488ACE5CA972D2D735EC11CB62

Function 00B063B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 120c39b7adbdc5da4d2aa978256971a2a10253a4b9e664eddcc942f30ae2c0dd
Instruction ID: 90f8c108375d61d8f658525bcbe49c824962deca4f4e125eeb6765d96e4f7418
Opcode Fuzzy Hash: 120c39b7adbdc5da4d2aa978256971a2a10253a4b9e664eddcc942f30ae2c0dd
Instruction Fuzzy Hash: 83319370649301BAD624DB08CD82F2FBBE5EB81B51FA48558F1815B2D1D770AC218B56

Function 00AD0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8945648be5288b5e7e59922f0f5247cea752d48f81553378adc07d4b2aad06
Instruction ID: 0c9bb6a3f59ecf4bdd5c45801b403d051459f3c21492b58576f17a6678a754fb
Opcode Fuzzy Hash: cb8945648be5288b5e7e59922f0f5247cea752d48f81553378adc07d4b2aad06
Instruction Fuzzy Hash: 73210CB490021A9FDB15CF94CC90FBEBBB1FB4A304F244859E512BB391C735A911CB64

Function 00B03220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00B032A6

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 184ab1cffd328a4f9ed7569e66752e796e05cca06d923401ed1e54caf4317376
Instruction ID: bcd96d9b8c2343f1c6dac7d401baf503206eccb2f8e34a9f275451d0f2ef248b
Opcode Fuzzy Hash: 184ab1cffd328a4f9ed7569e66752e796e05cca06d923401ed1e54caf4317376
Instruction Fuzzy Hash: 5D01693450D2409BC701EF18E889A1ABBE8EF4AB00F45885CE5C58B3A1D735DD60CBA6

Function 00B03202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00B03208

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b82a391390f88c0438c423a0a2e583736632a40f1654d7bbcf4452ee250b148f
Instruction ID: ae5005786bb0233b9c5d4d2aa252c668af86920b4555a9afb2ba5d170e1ec333
Opcode Fuzzy Hash: b82a391390f88c0438c423a0a2e583736632a40f1654d7bbcf4452ee250b148f
Instruction Fuzzy Hash: F5B012301400006FDA041B00EC0AF003510EB00605FC00050A100050F1D5655D64C554

Non-executed Functions

Function 00AF23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

|}&C, xrefs: 00AF2F21
#v, xrefs: 00AF344B, 00AF4861
f@~!, xrefs: 00AF25FF
mlc@, xrefs: 00AF275C
ggxz, xrefs: 00AF2685
3<, xrefs: 00AF32D6
Cx, xrefs: 00AF453D
fedc, xrefs: 00AF2782
aenQ, xrefs: 00AF276A
`tii, xrefs: 00AF2693
{l`~, xrefs: 00AF268C
:, xrefs: 00AF32DD
%*+(, xrefs: 00AF40EF

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 0a384682f60fe56ee7611e9e1b6decc840d8b8842033e208530b06f4de82ab14
Instruction ID: b4a2761d2a1f5c895b961406a17acc1543cf46895733334c2fc3746f99ed172b
Opcode Fuzzy Hash: 0a384682f60fe56ee7611e9e1b6decc840d8b8842033e208530b06f4de82ab14
Instruction Fuzzy Hash: 4C33CB70104B818FDB258F79C590762BBF1BF16304F58899DE5DA8BB92C735E806CBA1

Function 00ADDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

tuJK, xrefs: 00ADE967
WP, xrefs: 00ADDCEF
()./, xrefs: 00ADE9CA
<=2, xrefs: 00ADEA01
T, xrefs: 00ADF157
mjkh, xrefs: 00ADE7D8
dcba, xrefs: 00ADE728
DCBA, xrefs: 00ADE887, 00ADE896
D, xrefs: 00ADE846
@ONM, xrefs: 00ADE6DB
89&', xrefs: 00ADE93B
`Y^_, xrefs: 00ADE99E
<=:;, xrefs: 00ADE930
%*+(, xrefs: 00ADDE37, 00ADDE46
lkji, xrefs: 00ADE73E
LKJI, xrefs: 00ADE6E6
tsrq, xrefs: 00ADE6FC
`onm, xrefs: 00ADE733
xgfe, xrefs: 00ADE71D
QNOL, xrefs: 00ADE775
:WUE, xrefs: 00ADF6B7, 00ADF6C6
|, xrefs: 00ADECB1
89>?, xrefs: 00ADE9F6
AR, xrefs: 00ADDD10

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 4bb906169aa59cfe436aad9729c36a8a8257f23ae6c5c0388329684c824158ff
Instruction ID: f758bd9fa0dd96eb44d5ecdccfef9f9795a0c66ed2f7d163e0bc39438cf8c7a4
Opcode Fuzzy Hash: 4bb906169aa59cfe436aad9729c36a8a8257f23ae6c5c0388329684c824158ff
Instruction Fuzzy Hash: 64F255B05093819FD770DF14C884BABBBE6AFD5344F54482EE4CA8B391DB719984CB92

Function 00AE9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

Gt, xrefs: 00AE9FF8
CG, xrefs: 00AEAA32
(a*c, xrefs: 00AEA147
_Y, xrefs: 00AEA641
/), xrefs: 00AEA66D
S], xrefs: 00AEA636
=], xrefs: 00AEA36A
?m,o, xrefs: 00AEA13C
JG, xrefs: 00AEAA27
%e6g, xrefs: 00AEA152
sm, xrefs: 00AEA830
WH, xrefs: 00AEAA1C
]{, xrefs: 00AEA1E7, 00AEA1F3
hi, xrefs: 00AEAB9D
kW, xrefs: 00AEA380
WQ, xrefs: 00AEA62B
N[, xrefs: 00AEA375

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 6cf94137cd7488c25dea9c4200c329a6b900abb00a2c29382df5f1d25ed9b8bc
Instruction ID: d7f0be9c34dfa9cf41782b41fcb1260f0ad51a1084995177e6a15f1558b7fdc3
Opcode Fuzzy Hash: 6cf94137cd7488c25dea9c4200c329a6b900abb00a2c29382df5f1d25ed9b8bc
Instruction Fuzzy Hash: 2052B6B444D3858AE270CF26D681B8EBAF1BB92740F608A1DE1ED9B255DB708045CF93

Function 00AE9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

pq, xrefs: 00AE99E0
B?Q9, xrefs: 00AE9B0B
B7U1, xrefs: 00AE9AFB
,A&C, xrefs: 00AE982E
2A"_, xrefs: 00AE9980
T#a-, xrefs: 00AE9AE3
8;, xrefs: 00AE9B13
!E4G, xrefs: 00AE9836
?M0K, xrefs: 00AE9968
;IJK, xrefs: 00AE983E
G+X5, xrefs: 00AE9AF3
G'M!, xrefs: 00AE9ADB
L3Y=, xrefs: 00AE9B03
X/R), xrefs: 00AE9AEB
O+f), xrefs: 00AE9634, 00AE963D
z=Q?, xrefs: 00AE9826

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: fa63294a2e3d9c3de60ceb273a72e1147931f49f6576d9d0f2c2068ae9506c39
Instruction ID: b4386076012f5c40e8c8c3a8690c163557d1deee6e83fd71a56cbcb65fa740bf
Opcode Fuzzy Hash: fa63294a2e3d9c3de60ceb273a72e1147931f49f6576d9d0f2c2068ae9506c39
Instruction Fuzzy Hash: 53F14FB0518380ABD310DF16D981A2BBBF4FB86B88F544D1CF4D99B252D374D909CBA6

Function 00AEDD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

n\+H, xrefs: 00AEDDC0
,Q?S, xrefs: 00AEE26F
upH}, xrefs: 00AEDE8A, 00AEE798, 00AEDF4A
{E, xrefs: 00AEE323
hX]N, xrefs: 00AEDDC7
=]+_, xrefs: 00AEE276
)IgK, xrefs: 00AEE261
Y9N;, xrefs: 00AEE245
<Y.[, xrefs: 00AEE27D
-M2O, xrefs: 00AEE25A
%*+(, xrefs: 00AEE143

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: 58f7179f30031ec4a9c60eac55bf9cfb7af63a6b6284d469cbca94f26dbe6345
Instruction ID: fb13378654077cf07a264be0371fcf9c7734820dd4aff5890f61a5d00de35c3b
Opcode Fuzzy Hash: 58f7179f30031ec4a9c60eac55bf9cfb7af63a6b6284d469cbca94f26dbe6345
Instruction Fuzzy Hash: C2921471E00245CFDB14CF69D8917AEBBB2FF49310F298268E556AB391D735AD02CB90

Function 00C969C4 Relevance: 11.6, Strings: 8, Instructions: 1600COMMON

Download Yara Rule

Strings

3][, xrefs: 00C978C5
%pm=, xrefs: 00C9730B
hwn, xrefs: 00C97613
^Es, xrefs: 00C9763A
g~, xrefs: 00C96D9E
[^z|, xrefs: 00C97C68
,[?, xrefs: 00C96E66
n-Zm, xrefs: 00C972E0

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %pm=$,[?$3][$[^z|$^Es$hwn$n-Zm$g~
API String ID: 0-432285966
Opcode ID: ac328b5af41210f759cc714adf3bd672decc61632c9afe7319879b49c5740c14
Instruction ID: 022c00b7ccca4d78fe1f6585194537614c323e01f055f547bf170f452b51e228
Opcode Fuzzy Hash: ac328b5af41210f759cc714adf3bd672decc61632c9afe7319879b49c5740c14
Instruction Fuzzy Hash: 4DB2F6F390C2049FE304BE29EC8567ABBE9EF94720F1A493DEAC4C3744E63559058693

Function 00AE098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

qrqp, xrefs: 00AE1089
gce/, xrefs: 00AE1073
%*+(, xrefs: 00AE0A77, 00AE0A86
,#15, xrefs: 00AE0F94
&> &, xrefs: 00AE0F89
cah`, xrefs: 00AE107E
{, xrefs: 00AE1502
9.5^, xrefs: 00AE0F9F

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 96648c75832fcecfdec4d0085d4fb5a7e1577d95b900f103c555f4eaa0acd6fa
Instruction ID: 70f23a3fa331b0d02a504e5450d4ed4cf1ded3562ccdde432f0a8b31989326ca
Opcode Fuzzy Hash: 96648c75832fcecfdec4d0085d4fb5a7e1577d95b900f103c555f4eaa0acd6fa
Instruction Fuzzy Hash: 7062A8B16083818BD730DF15D895BAFBBE1FF96314F08492DE49A8B681E7758980CB53

Function 00AC1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00AC1587, 00AC15F8
@, xrefs: 00AC2C40
gfff, xrefs: 00AC2226
gfff, xrefs: 00AC22E1
0123456789ABCDEFXP, xrefs: 00AC157D, 00AC15EB
gfff, xrefs: 00AC2297
-, xrefs: 00AC21ED

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 35787dd278db018460749c1c6f1d448644826883557698da22bcd214dd3e113f
Instruction ID: dda0b30bfa2a50f51e2cf933259688037b0e84f17ea299f99f7b686a0c9365f3
Opcode Fuzzy Hash: 35787dd278db018460749c1c6f1d448644826883557698da22bcd214dd3e113f
Instruction Fuzzy Hash: 60D2F5726083418FD718CF28C494B6ABBE2AFD5314F1ACA2DE4958B391D734DD45CB82

Function 00C9D5BF Relevance: 10.3, Strings: 7, Instructions: 1571COMMON

Download Yara Rule

Strings

hw$, xrefs: 00C9DAD7
r43?, xrefs: 00C9E46D
P#, xrefs: 00C9D706
__V, xrefs: 00C9E145
0;>, xrefs: 00C9DB4D
J/, xrefs: 00C9E4C1
n,~{, xrefs: 00C9DA04

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: P#$__V$hw$$n,~{$r43?$0;>$J/
API String ID: 0-1574053673
Opcode ID: ed188811c67634c2f48406612963ae9639201e7a06af3f22298b5b24834c20b9
Instruction ID: 645a6ba384a9f827fcd9f0c19b5e612cddb2845a3fef1025beedf4232b2fb226
Opcode Fuzzy Hash: ed188811c67634c2f48406612963ae9639201e7a06af3f22298b5b24834c20b9
Instruction Fuzzy Hash: 43B2D1F360C6009FE304AF29EC8166AFBE5EF94720F16893DEAC5C3744E63598458697

Function 00C8E35A Relevance: 9.0, Strings: 6, Instructions: 1533COMMON

Download Yara Rule

Strings

C@|\, xrefs: 00C8E665
[-iU, xrefs: 00C8EE5C
x7_, xrefs: 00C8EBB5
z>:o, xrefs: 00C8EBAF
$~_{, xrefs: 00C8ED69
n.!@, xrefs: 00C8E5F4, 00C8E609, 00C8E622, 00C8E608, 00C8E65C

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: $~_{$C@|\$[-iU$n.!@$x7_$z>:o
API String ID: 0-869803711
Opcode ID: ed5cb1f75c5d4a8fb5dc72d07e6a06096ed3199793b46350b6b1ca3250d8be25
Instruction ID: 95bef9634fdb05ed4951800324bbaa031fb0d12c1091081a8ee92e6247ced04e
Opcode Fuzzy Hash: ed5cb1f75c5d4a8fb5dc72d07e6a06096ed3199793b46350b6b1ca3250d8be25
Instruction Fuzzy Hash: E9A206F3A082049FE3046E2DEC8567AFBE9EF94720F1A493DE6C4C7744E63598058697

Function 00C9187E Relevance: 7.9, Strings: 5, Instructions: 1673COMMON

Download Yara Rule

Strings

~f{_, xrefs: 00C9195A
el;, xrefs: 00C923A8
XZ{o, xrefs: 00C9195F
*4Ez, xrefs: 00C92678
66Wn, xrefs: 00C925F2

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: *4Ez$66Wn$XZ{o$el;$~f{_
API String ID: 0-1335471841
Opcode ID: 0bd510bf6fbfae0838d2a263572557b2880a99e7aa8d22326fd45bffc7aee720
Instruction ID: 09fb9e27793a12e2898b855b2ea42f68d8703bbb18c70b47f94996ca1f99df42
Opcode Fuzzy Hash: 0bd510bf6fbfae0838d2a263572557b2880a99e7aa8d22326fd45bffc7aee720
Instruction Fuzzy Hash: EEB228F36082049FE704AE3DEC8567ABBE6EBD4320F1A863DE6C5C3744E93558058696

Function 00C984B9 Relevance: 7.9, Strings: 5, Instructions: 1669COMMON

Download Yara Rule

Strings

pU/>, xrefs: 00C99455
.z, xrefs: 00C98D96
`Hm=, xrefs: 00C98804
.h;, xrefs: 00C98A99
]V{, xrefs: 00C985FB

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: .h;$]V{$`Hm=$pU/>$.z
API String ID: 0-951304034
Opcode ID: 3cba3322afc2fa08f6af3d4155cc8533917bc768e5661037339922feea2ed4bd
Instruction ID: ae228f743850cb05fa34371b7d5ee99562fe798dd6823b1aa124c2f97b4abef1
Opcode Fuzzy Hash: 3cba3322afc2fa08f6af3d4155cc8533917bc768e5661037339922feea2ed4bd
Instruction Fuzzy Hash: 78B228F360C2009FE3046E2DEC8567ABBE9EF94360F1A893DE6C4C7744E67558058697

Function 00C934A1 Relevance: 7.9, Strings: 5, Instructions: 1625COMMON

Download Yara Rule

Strings

aPr, xrefs: 00C940A3
\u-, xrefs: 00C944C3
Q<^, xrefs: 00C938F6
8g}, xrefs: 00C934CB
3~o, xrefs: 00C9367D

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: Q<^$3~o$8g}$\u-$aPr
API String ID: 0-3439627576
Opcode ID: 8b57dadbfc6e5a88ad27ef76b54112dc5829a44c793a259d58529ebb33b63eb5
Instruction ID: 421c59ec6e4a97d98f84f2de5366ebfa7a19a4b61408d4b90c2e04616f464da6
Opcode Fuzzy Hash: 8b57dadbfc6e5a88ad27ef76b54112dc5829a44c793a259d58529ebb33b63eb5
Instruction Fuzzy Hash: BBB236F360C2049FD304AE2DEC4567AFBE9EFD4720F1A492DEAC4C7744EA3598418692

Function 00AC12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

i, xrefs: 00AC28EA
0, xrefs: 00AC1DC1
0, xrefs: 00AC243E
@, xrefs: 00AC3531
0, xrefs: 00AC1E88

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 043410111222df818736a0977333a9cb5908da7352497e510f80c90383c10f06
Instruction ID: 8b6b1aa46835f74ca7e6749fef0908ee1ce0d42cad8a6fd8e65c362af774c163
Opcode Fuzzy Hash: 043410111222df818736a0977333a9cb5908da7352497e510f80c90383c10f06
Instruction Fuzzy Hash: B562DF7160C3818FD719CF28C590B6ABBE1AFD5304F198A2DE8D987292D774DD49CB82

Function 00AC164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00AC1659
gfff, xrefs: 00AC1F57
+, xrefs: 00AC1573
0123456789ABCDEFXP, xrefs: 00AC164F
gfff, xrefs: 00AC1F3C

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 18fb58a4de47e5c57543ea4e517eba5397abf050edc7a45e46b55bf70731a0da
Instruction ID: 58bdca55455f9c9e5c7eee4cc549150aff9d6faea027dc19cbe2cd1458563cf4
Opcode Fuzzy Hash: 18fb58a4de47e5c57543ea4e517eba5397abf050edc7a45e46b55bf70731a0da
Instruction Fuzzy Hash: B1F19F3160C3818FC719CF29C484B6AFBE2ABD9304F198A6EE4D987352D774D945CB92

Function 00AC13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00AC13AD
gfff, xrefs: 00AC1F57
-, xrefs: 00AC1F23
0123456789ABCDEFXP, xrefs: 00AC13A3
gfff, xrefs: 00AC1F3C

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 3c11beac305553ff0e7fa59861e3fe581f9aefdd9425ab7eeef2d759a2f66b81
Instruction ID: 1f2c4a87d6b6ee54f3ff23413721f224d6dfb883e319307e9576fedbe033eac0
Opcode Fuzzy Hash: 3c11beac305553ff0e7fa59861e3fe581f9aefdd9425ab7eeef2d759a2f66b81
Instruction Fuzzy Hash: 41D18D3160C7818FC719CF29C48476AFBE2ABD9304F09CA6EE4D987356D634D949CB92

Function 00C9A0FD Relevance: 6.6, Strings: 4, Instructions: 1592COMMON

Download Yara Rule

Strings

v?~, xrefs: 00C9B0BC
BZm}, xrefs: 00C9AE93
10.6, xrefs: 00C9B098
Y{|w, xrefs: 00C9B237

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: v?~$10.6$BZm}$Y{|w
API String ID: 0-3669587384
Opcode ID: 3343751edce544d444ae9bc2162fc08fa34f5e138cc3bbd4b7e05b51618404ea
Instruction ID: fa7f75b3b772f1547793e45d62c7512bc434d6ace0f52c12f78c8957f59d7ab0
Opcode Fuzzy Hash: 3343751edce544d444ae9bc2162fc08fa34f5e138cc3bbd4b7e05b51618404ea
Instruction Fuzzy Hash: DDB2F4F350C200AFE708AF29EC8567AFBE5EF94320F1A493DE6C583744EA3598458657

Function 00AEFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

m1s3, xrefs: 00AEFEC3, 00AEFECB
uvw, xrefs: 00AEFE95
NA_I, xrefs: 00AF036D
:, xrefs: 00AF0087

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: b3f2fcab4bfd106115c3d18a5b622936222cc954779ad3ecd31bf5f11b6a0791
Instruction ID: ef57a56b77f76bc16eb469772b19d599bb7e2b091a59f5b570debde7f6bfa4e4
Opcode Fuzzy Hash: b3f2fcab4bfd106115c3d18a5b622936222cc954779ad3ecd31bf5f11b6a0791
Instruction Fuzzy Hash: 1B32A8B0508384DFD310DF69D880B6ABBE1AF8A350F548E6CF6D58B2A2D735D905CB52

Function 00C9F01D Relevance: 5.4, Strings: 3, Instructions: 1685COMMON

Download Yara Rule

Strings

gllw, xrefs: 00C9F0B4
?`u, xrefs: 00CA00B8
k@;, xrefs: 00C9F70C

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: ?`u$gllw$k@;
API String ID: 0-2157141777
Opcode ID: 1b6f8f56d0b272a70668b064b1b680ac3f568e324964ba6453ffd74be17f0ea2
Instruction ID: 9b9e92b48bff361495caa90add29046599d7fc492e40a60514aea990d2bfa5c3
Opcode Fuzzy Hash: 1b6f8f56d0b272a70668b064b1b680ac3f568e324964ba6453ffd74be17f0ea2
Instruction Fuzzy Hash: 00B247F3A082049FE304AE2DEC8567AFBE9EFD4720F1A453DEAC4C7744E63558058696

Function 00AD3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

ss, xrefs: 00AD3C79
%*+(, xrefs: 00AD3EC4
p, xrefs: 00AD3C80
;z, xrefs: 00AD3C87

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 90fc4e93126ba05af6cb57ac5e80ed65b2b1159ef594b2ba8e6dd5c78020f719
Instruction ID: adeaf10a851dec7e383273ba72d2e36622d9ea28cc55c57943f7e768d9a7f6dd
Opcode Fuzzy Hash: 90fc4e93126ba05af6cb57ac5e80ed65b2b1159ef594b2ba8e6dd5c78020f719
Instruction Fuzzy Hash: C5024AB4810B00EFD7609F25D986756BFF5FB05300F50895DE89A8B796E730A818CBA2

Function 00AE2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 00AE2317
sj, xrefs: 00AE2327
lc, xrefs: 00AE2507
hu, xrefs: 00AE232F

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 8d447bb4e643499e19fe399ad0d264b6cec15e8f87a21a9a130264edfb202a98
Instruction ID: 4f2021d8c27120c96b28206ed39e3ef9f79240e2ff8920704f8b01b7cca7fec7
Opcode Fuzzy Hash: 8d447bb4e643499e19fe399ad0d264b6cec15e8f87a21a9a130264edfb202a98
Instruction Fuzzy Hash: EFA19CB44083818BC720DF19C891B2BB7F4FF95754F588A0CE8D99B291E379D941CBA6

Function 00C8ADF7 Relevance: 5.4, Strings: 3, Instructions: 1620COMMON

Download Yara Rule

Strings

L><, xrefs: 00C8AE0E
)olU, xrefs: 00C8B0F4
d], xrefs: 00C8B79B

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: )olU$d]$L><
API String ID: 0-2988762515
Opcode ID: 8e4d5610914544abbc9b99b39015b8d83411e2b3f7f88af2c15caf9791d04d1a
Instruction ID: 91a9336518b56c9a09e0246ab63db8c05018010acb8e47c3c967e5e58d39760c
Opcode Fuzzy Hash: 8e4d5610914544abbc9b99b39015b8d83411e2b3f7f88af2c15caf9791d04d1a
Instruction Fuzzy Hash: 55B218F3A08204AFE3046E2DEC8567AFBE9EFD4720F1A853DE6C4C7744E63558058696

Function 00C94F86 Relevance: 5.3, Strings: 3, Instructions: 1535COMMON

Download Yara Rule

Strings

ej;g, xrefs: 00C9541C
!\}W, xrefs: 00C956EF
+=w, xrefs: 00C95AC3

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: !\}W$+=w$ej;g
API String ID: 0-3140140332
Opcode ID: 72dbc88919191e947fe923f0bdf453ec7c983e57a827634affa72b15a39fc815
Instruction ID: 0b092491bce96255829556029ad8ebc5521881c7286faf4f86fc981b87ecd7bd
Opcode Fuzzy Hash: 72dbc88919191e947fe923f0bdf453ec7c983e57a827634affa72b15a39fc815
Instruction Fuzzy Hash: AEB2D4F390C200AFE3046F29EC4567ABBE9EF94720F16492DEAC5C7344E63598458B97

Function 00AED7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

T>, xrefs: 00AED984
KV, xrefs: 00AED97D
CV, xrefs: 00AED98B
#', xrefs: 00AED9EA

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c5df68c766071eec162ad97a747ac9f727dabc9be7665b7468a099d9b602568f
Instruction ID: 7efb0d81ab45c7f900d35ed44aa68e29a2a93f4e4fefe19dad3e053174d32545
Opcode Fuzzy Hash: c5df68c766071eec162ad97a747ac9f727dabc9be7665b7468a099d9b602568f
Instruction Fuzzy Hash: 268146B48017499FDB20DFA6D68556EBFB1FF12300F60560CE486ABA55C330AA55CFE2

Function 00AEAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

lk, xrefs: 00AEACBC
,{*y, xrefs: 00AEAD07, 00AEAD13
4c2a, xrefs: 00AEACA9
(g6e, xrefs: 00AEACA1

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f2483cec160b40632031d01decbd1da6ec321adccbf519055d9633815038279f
Instruction ID: 34167311111b5f4079dd41f37b961515e8ba3deabe4c416d93d46b427903d9f2
Opcode Fuzzy Hash: f2483cec160b40632031d01decbd1da6ec321adccbf519055d9633815038279f
Instruction Fuzzy Hash: ED4186B4808381CBD7209F25D944BABB7F0FF86305F54995DE6C897260EB31DA44CB96

Function 00AEC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AEC9E4, 00AEC9ED
~/i!, xrefs: 00AEC537
%*+(, xrefs: 00AEC8C3, 00AEC8CB

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: bc3c44eae82a6a4fcf645d6cd90b9fe60d6f7cf29c4fc78decbfcd2f3a06ca48
Instruction ID: ad57be22cd62a06eb7f6cf13527c2d0b71e929a56f8d59b871c614d0199d0f46
Opcode Fuzzy Hash: bc3c44eae82a6a4fcf645d6cd90b9fe60d6f7cf29c4fc78decbfcd2f3a06ca48
Instruction Fuzzy Hash: D5E188B5508384DFE3209F69D881B5BBBF5FB85350F448C2CE69987292DB32D811CB92

Function 00AC8590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00AC860C
), xrefs: 00AC8616
IEND, xrefs: 00AC89F0

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 0102dde2a7979b4782866d40d3ffb696ce1e7f3cd7de7cea1cbef87c40188d49
Instruction ID: f457ac0afb0bbb2e8e0600eda64f77a400e63b258cd409a797696392815e2563
Opcode Fuzzy Hash: 0102dde2a7979b4782866d40d3ffb696ce1e7f3cd7de7cea1cbef87c40188d49
Instruction Fuzzy Hash: 80E1E0B1A087019FE310CF29C885B2ABBE0FB94354F15492DF59997381DB79E915CBC2

Function 00C9BB40 Relevance: 4.1, Strings: 2, Instructions: 1581COMMON

Download Yara Rule

Strings

/Y$U, xrefs: 00C9C2AE, 00C9C2D4, 00C9C34C
Rlwu, xrefs: 00C9C6BE

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: /Y$U$Rlwu
API String ID: 0-3254789073
Opcode ID: a88d73490862ab34d791a1deaadcb0ebd9bf378e11a7b2d542651a32873d1e53
Instruction ID: 621e35bd862e18eaa14fa53086fe81bfd12f7203dec769edf6d49d026286f28d
Opcode Fuzzy Hash: a88d73490862ab34d791a1deaadcb0ebd9bf378e11a7b2d542651a32873d1e53
Instruction Fuzzy Hash: 88B218F3A0C200AFE7046E2DEC4567AFBE9EF94720F16492DE6C5C3744EA3598008697

Function 00B04040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B040A4, 00B040AD
f, xrefs: 00B0420C

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: ef62ba71a82793e42a446d4b46e23a4eb0edc7322f59953251b7cff3524fa322
Instruction ID: 7e59ea926acab4258d0f712b0dd717907fe05fe0daa9e71791b39449b35abcbf
Opcode Fuzzy Hash: ef62ba71a82793e42a446d4b46e23a4eb0edc7322f59953251b7cff3524fa322
Instruction Fuzzy Hash: A1129CB16083419FC715CF18C880B2FBBE6FBC9314F588AACF69497291D771E9458B92

Function 00AFF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 00AFF6E6
dg, xrefs: 00AFF7F5

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 8dccaff7378d978f34d22f6eaad52544d2cec8701feedcae27d4cd5856688d00
Instruction ID: 133e12b45406b5d52fde536bbbf16124197892386c6e710bb49aba7202f9be43
Opcode Fuzzy Hash: 8dccaff7378d978f34d22f6eaad52544d2cec8701feedcae27d4cd5856688d00
Instruction Fuzzy Hash: 60F19171618301EFE704CF64D891B6ABBF6EF86344F64992CF2858B2A1CB34D945CB52

Function 00AC35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 00AC360E
Inf, xrefs: 00AC3607

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 8db32cd1fc1ee20e9a9d756040613957ee4ab54a6b676f53597c3a87ab892694
Instruction ID: 16bf881efc471e4815e8678d01c24604c9460edabbd8ae160ab4528d8bb6a443
Opcode Fuzzy Hash: 8db32cd1fc1ee20e9a9d756040613957ee4ab54a6b676f53597c3a87ab892694
Instruction Fuzzy Hash: DBD1C672A083119BCB04CF29C980B5FB7E5EBC8750F15C92DF999973A0E675DD058B82

Function 00ADFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00AE0197
Ye[g, xrefs: 00AE00F6

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 5edd52a164d5f4775fd02a47a58c82caad5ebbce8f5f1b9ec5988b9a3f68caa3
Instruction ID: 1e9b9ce52986eb98f85d1df78389baebc281e82c18d4cb5665520a0e52b7d45b
Opcode Fuzzy Hash: 5edd52a164d5f4775fd02a47a58c82caad5ebbce8f5f1b9ec5988b9a3f68caa3
Instruction Fuzzy Hash: 5F51ACB16083818BD731CF56C481BABB7F0FF96360F19491DE49A8B651E3B49980CB57

Function 00C87FAE Relevance: 2.1, Strings: 1, Instructions: 846COMMON

Download Yara Rule

Strings

?Rn, xrefs: 00C880BB

Memory Dump Source

Source File: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: ?Rn
API String ID: 0-3175283865
Opcode ID: 4b0c1f63371da07f7d941e4df5b6f0f77a6d2017c795edf57545f676908ea289
Instruction ID: 00a40d06e98d6a4b4988b9960616d2c19d239dfef30cc930715bbf4c23e39a36
Opcode Fuzzy Hash: 4b0c1f63371da07f7d941e4df5b6f0f77a6d2017c795edf57545f676908ea289
Instruction Fuzzy Hash: 5942D3F3A082009FD318AE2DDC4567ABBE5EF94720F16893DEAC5C3344EA3598158787

Function 00AC5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00AC54C8

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: d67c433c2aafea8ee7b5470d2c156e9bbea842d7543c41dbde0403c42de30ab8
Instruction ID: 9c83c001bba4939aa43703ac2f7ea10e3fa56e78abdea0f10158cb89f36c4898
Opcode Fuzzy Hash: d67c433c2aafea8ee7b5470d2c156e9bbea842d7543c41dbde0403c42de30ab8
Instruction Fuzzy Hash: AD22A1B6E08B428BE7158F289940B26BBA2AFA1314F1E856DF8594B341E771FCC5C741

Function 00AF12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00AF15D1

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 4271f092ed29110a52bdf7f711f1d826c5023955ca299aa7cb425812e14bde18
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: EAF13571A083498FC724CF65C490A3BBBE6AFC5350F18C96DF99A8B382D635DD058792

Function 00AEAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AEB2D3, 00AEB2DB

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5087a9f85a74570f50e028006c0e457e90dbd0d48fc5615c3b12a82fa72e6042
Instruction ID: 3b1385b5e6aeda6a3fc4e7b6e8bbb12a29f27716b360531d9dc2dd2c4925a1f6
Opcode Fuzzy Hash: 5087a9f85a74570f50e028006c0e457e90dbd0d48fc5615c3b12a82fa72e6042
Instruction Fuzzy Hash: 25E1BA71518346CBC324DF2AC4945AFB3F2FF98791F54891CE5C587260E730AA55CBA2

Function 00AD6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AD6EF3

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b4db055ea121b3dd21aefdd161e0f7ac1a7ee6b2d9faeaba075d8573d59f1fb3
Instruction ID: 53fb1885ee2bc5bec16cfd78ea8e9945c975535e1c9319a0b00eb5363bb04b7d
Opcode Fuzzy Hash: b4db055ea121b3dd21aefdd161e0f7ac1a7ee6b2d9faeaba075d8573d59f1fb3
Instruction Fuzzy Hash: D9F19BB5A00A01CFD734DF25D981A26B3F6FF58354B148A2EE49787BA1EB35E815CB40

Function 00AE7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AE8263, 00AE826B

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 882afb45bdd680188eb4314b340c46cbd15b091394b0df227edd989628a12647
Instruction ID: 055b9345a4ccd0af8c37393e4166fde8b6c4b0027acce2c04a98e18b957947f2
Opcode Fuzzy Hash: 882afb45bdd680188eb4314b340c46cbd15b091394b0df227edd989628a12647
Instruction Fuzzy Hash: 61C1B071508340ABD710EF16C882A2BB7F5EF95754F08891CF8C99B291E739ED15CBA2

Function 00AE8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AE9233, 00AE923B

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e12328fa0d2c6a7c5a0bc12c39fdd4bee4a23555a234270fe14f9858b5c696b7
Instruction ID: 0b7876cd4e28ba73330e04f300b4882bd1c1df493f92b55fb0768515cdbe01c3
Opcode Fuzzy Hash: e12328fa0d2c6a7c5a0bc12c39fdd4bee4a23555a234270fe14f9858b5c696b7
Instruction Fuzzy Hash: FAD1E070628342DFD704EF65EC91A6AB7E5FF89304F89887CE88687291DB74E940CB51

Function 00B07FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00B08167

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 5cd2ce99535949e2103b79a24bd7e1bc026800b0432d6fd94e24fe39be10ee85
Instruction ID: 2cdcf7b1b3bd32679fb2598582a6f40eb4ea8f940cbdb62cadaa07bae0a0134e
Opcode Fuzzy Hash: 5cd2ce99535949e2103b79a24bd7e1bc026800b0432d6fd94e24fe39be10ee85
Instruction Fuzzy Hash: C7D1D4729082658FC725CE18D89071FBAE1EB85718F15866CE8E5AB3D0DB71DD06C7C1

Function 00AECCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AECDC3, 00AECDCB

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 6d57bc6e77d6704742945464706c20bcaa15d66c0754bbeb84c4d8c065aff148
Instruction ID: d4a543b8b52a5a3f36235774b32f7b15cdd3a5b5f399737d361027c85da75998
Opcode Fuzzy Hash: 6d57bc6e77d6704742945464706c20bcaa15d66c0754bbeb84c4d8c065aff148
Instruction Fuzzy Hash: EEB1FF706083859BD714DF1AD881B3BBBF2EF85360F18492CE5C58B291E335E956CB92

Function 00ACA850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00ACA9C3

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: 71d0d823128a1e5d9bf0bcc638521ceca85be79a0624d2b4264760d55026d241
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 0CB129711083859FD324CF68C880B1BBBE1AFA9708F458A2DF5D997342D671EA18CB57

Function 00AFFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AFFCA4, 00AFFCAD

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 65c5952885989545a614206466e7d9dd6934ca026d497c36776257fc08ce4c2f
Instruction ID: d1d6c6cf108941d8c19ff3b265e431309e13f4521f6750bbc37e964536ac86a8
Opcode Fuzzy Hash: 65c5952885989545a614206466e7d9dd6934ca026d497c36776257fc08ce4c2f
Instruction Fuzzy Hash: 6281AB71608309EFD720DF98D885A2ABBF5FF99705F44882CF68497291DB31D815CB62

Function 00ADD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ADD663, 00ADD66B

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4392c21b0c2f3d370299d33ef21e550aa5b685f2e6ebb55faffe002c6a3634d2
Instruction ID: ae14694140a530408f76604c6b679685744a1233c4db2544032ea87984712867
Opcode Fuzzy Hash: 4392c21b0c2f3d370299d33ef21e550aa5b685f2e6ebb55faffe002c6a3634d2
Instruction Fuzzy Hash: 83610171918204DBD710EF18EC82A6AB3B1FF94354F48492DF88A9B391E775E910C792

Function 00B04A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B04C33, 00B04C3B

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b805953c3e9ac931d9b9f8339b60d579166592dfbdaf5f057bba7b8692f87ec4
Instruction ID: 6a6bd3cb53210166ce0e8af3bc3152fd0be4033f323328708a1d4cbb9aba414a
Opcode Fuzzy Hash: b805953c3e9ac931d9b9f8339b60d579166592dfbdaf5f057bba7b8692f87ec4
Instruction Fuzzy Hash: F261CFB16083419BE721DF25D880B2ABFE6EBC4314F58899CEAC5872D1D771EC54CB92

Function 00ACE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00ACE333

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 3a36430c5c7bfa30d654478a39d9051229cef2d1b7ae025c5d3430307b399289
Instruction ID: ec50fa74ed801859ff9db04ce9704add950ab97d6c7634892cc830b7ecb458a1
Opcode Fuzzy Hash: 3a36430c5c7bfa30d654478a39d9051229cef2d1b7ae025c5d3430307b399289
Instruction Fuzzy Hash: 07511533A196D04BD728CA3C4C567A96ED70FA2334B2EC76EE9F18B3E1D65588008390

Function 00B03920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B039E3, 00B039EB

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 040694cb97fbba82253010ec2e8a47bd7b2fa339dce0bfb3aded6955ff990569
Instruction ID: 9f301d78e0f7a9e74f3ea57df556be2c636aeef4082cf810a26292bbb2a35261
Opcode Fuzzy Hash: 040694cb97fbba82253010ec2e8a47bd7b2fa339dce0bfb3aded6955ff990569
Instruction Fuzzy Hash: F1519E34609200DBCB24DF55D888A2EBFE9EF85B44F18889CE4C687291D772DE10CB62

Function 00AD1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00AD1C3E

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 7c08ded40fe02705c05235ed3fdcfe90e28c091439013fc0bd41531251adc57a
Instruction ID: 80502d1916eaf76428aac6ddc9c4f66ab65efd38278476203cc4701cc24e4c44
Opcode Fuzzy Hash: 7c08ded40fe02705c05235ed3fdcfe90e28c091439013fc0bd41531251adc57a
Instruction Fuzzy Hash: 4A4172B4018380ABC7149F64D894A2FBBF0FF96714F04891DF5D69B290D73ACA05CB5A

Function 00AFFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00B00033, 00B0003B

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 742dbf890cd8c7a02e8db3d188da192e6ea593086d929f51c7076b5252d1f5ff
Instruction ID: 4b2661fe146a8960526ac887365133dbadc10857f366dd2da31eb66b11b8ed9d
Opcode Fuzzy Hash: 742dbf890cd8c7a02e8db3d188da192e6ea593086d929f51c7076b5252d1f5ff
Instruction Fuzzy Hash: 923108B1A18309ABD610FA54DC81F2BBBE9EB85744F544868F885D72D2F632DC14C763

Function 00AEE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00AEE6A2

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 0be80de73b5e45f8149b4108efad8d8f1ede17e1865fef89f36666bac2ae76ab
Instruction ID: 6706e3a68633bfb115eed354bf3e5ab4a8ae9e064313fdb35adacc2b749c625c
Opcode Fuzzy Hash: 0be80de73b5e45f8149b4108efad8d8f1ede17e1865fef89f36666bac2ae76ab
Instruction Fuzzy Hash: 4D310AB5D00245CFCB20DF9AE9809AFBBB5FB06745F54482CE546A7301D731AD05CBA1

Function 00AD6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AD703B

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1e367a8148d8b3be62245c9e123ca57b240b952ab346cd5e97ac9a2daffb3599
Instruction ID: cdcabc42b115f4c8eaea840b69f50f62e5a82cbbebc2eee83577389cdd87257a
Opcode Fuzzy Hash: 1e367a8148d8b3be62245c9e123ca57b240b952ab346cd5e97ac9a2daffb3599
Instruction Fuzzy Hash: B8414275215B04DBD7398F61C995B2ABBF2FB49700F548819E58B9BBA1E731F8008B20

Function 00AEE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00AEE6A2

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: cf98d02336aa49b7771c24128c8fcd88ecc963206c9a28ada56833e9216c6e83
Instruction ID: 0f811ccce6f6e874a4a56ef7a1c49a34a3aee7845c2a2cbb9937c14c36dccfc1
Opcode Fuzzy Hash: cf98d02336aa49b7771c24128c8fcd88ecc963206c9a28ada56833e9216c6e83
Instruction Fuzzy Hash: F121F4B1900345CFC720CF9AD980AAFBBB5FB0A780F54481CE546AB301C331AD02CBA1

Function 00B09CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00B09D30

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 4f4436e3c599738f8c24fd121dad336a27f89265236ed64d7a2ae2f9815fa190
Instruction ID: 14400d8afcbda1d9dba906c896cd6a167c8976bf40b4147ee516b84fbaefda02
Opcode Fuzzy Hash: 4f4436e3c599738f8c24fd121dad336a27f89265236ed64d7a2ae2f9815fa190
Instruction Fuzzy Hash: 3D3178705083009BD310EF14D880A2BFBF9EF9A314F548A6CE5C597292D335D904CBA6

Function 00AD4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba52baaa31fdc69534314777d50646f7861a008300648a53368970b6574220f0
Instruction ID: 273b84d6d18d2f1942c0f0fb4783444406281d2318c990e1315d7e9062aacb38
Opcode Fuzzy Hash: ba52baaa31fdc69534314777d50646f7861a008300648a53368970b6574220f0
Instruction Fuzzy Hash: CC6246B4A00B408FD725CF25D990B26B7F6AF59700F548A2ED49B8BB52E735F804CB91

Function 00ACBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 9e4ff66748365beab1814d3a28425a34338cdad837e05ec1792d6fcad317ffb3
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: EE5209319087118BC7259F18D5407BBF3E1FFD5329F2A8A2DD9DA97280E734A851CB86

Function 00B08652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f8e429e6d756a0d602ffc359dacc3c984972570e05cbcdef8537104d52c3c2
Instruction ID: 886405f662626b3e60e1a7bc93ce263f09bc20a446ff88ee52ac6b761dfcae27
Opcode Fuzzy Hash: 73f8e429e6d756a0d602ffc359dacc3c984972570e05cbcdef8537104d52c3c2
Instruction Fuzzy Hash: BA22EE35608340DFC704DF68E89066ABBF1FF89315F4988ADE58987391DB31D960CB82

Function 00B086F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c50ef1358137fecc8514da8d451f3cdd86ee1a6b839af2b8188d4856e1e63b6
Instruction ID: e59a852dc705612c1444ddffc699a41f05eff85026d4506781aa4eaee75fbe5d
Opcode Fuzzy Hash: 7c50ef1358137fecc8514da8d451f3cdd86ee1a6b839af2b8188d4856e1e63b6
Instruction Fuzzy Hash: A122AA35608340DFC704DF68E89065ABBF1FB8A305F5989ADE5C987392DB35D960CB82

Function 00ACB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7954b70b52adbc5bf543b6220140a6bf67160a275d05ba126f3bdf34b3c2b1
Instruction ID: 6e96ea46970d23e3ef95b868e4d331f58609ef4e34d106d03554e863288edbee
Opcode Fuzzy Hash: 7a7954b70b52adbc5bf543b6220140a6bf67160a275d05ba126f3bdf34b3c2b1
Instruction Fuzzy Hash: 8F52FA709187888FE735CB24C086BA7BBE1EF95314F164C2DC5E706B82C77AA885C765

Function 00AC71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45aa4d49bf88be92cb91d2ff51d3da0fb1aebdc8151a872b857cb953581c7354
Instruction ID: ced2f28fdec48c874a46bd04aa2822e0f2e49059f971b9c84a514a887c0bf542
Opcode Fuzzy Hash: 45aa4d49bf88be92cb91d2ff51d3da0fb1aebdc8151a872b857cb953581c7354
Instruction Fuzzy Hash: 80527D7150C3458BCB15CF29C090BAEBBE1BF88314F1A8A6DE89A5B351D774D989CF81

Function 00AC8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7988f9eb0f649d4889b6c73bd60765b89fa219d16eb98e14d37f387d4d7dcc
Instruction ID: 67413851235e09781afeaae543f79ccb0867d887be8e3fe25b68a551f1cc6b6c
Opcode Fuzzy Hash: 9e7988f9eb0f649d4889b6c73bd60765b89fa219d16eb98e14d37f387d4d7dcc
Instruction Fuzzy Hash: D5425675608301DFD708CF28D854B9ABBE1BF98315F09886DE4A58B3A1DB35D985CF42

Function 00AC7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217e1fc2ec9e550f46012807ae742df811781a1b085bb49d44082822607c24a0
Instruction ID: 4ea0889e8ebfe117571324902e393445ca082b25dfca2efc75d4cb80cd38bbac
Opcode Fuzzy Hash: 217e1fc2ec9e550f46012807ae742df811781a1b085bb49d44082822607c24a0
Instruction Fuzzy Hash: D4321270518B118FC378CF29C590A6ABBF1BF45710B654A2ED6A787B90DB36F845CB10

Function 00B089A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a22e6a9803b5ed8325a5240a0dee1cdd7f51ef6c41511c09fc5661bca703e09
Instruction ID: 4be58e40d3323e61f79752da20c2788c0fc82c0ca0867b9cf71f0e842a312344
Opcode Fuzzy Hash: 4a22e6a9803b5ed8325a5240a0dee1cdd7f51ef6c41511c09fc5661bca703e09
Instruction Fuzzy Hash: 0A02A935608341DFC704DF68E880A1AFBE1EF8A305F4989ADE4C5873A2D736D954CB92

Function 00B08A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92566a1c0c2f114d5f1e51a8750bcc20832d69a3276a1608a3e7850198752b0
Instruction ID: 052bf44c0a607ade20959706d176a40dcc0eb6ecb0b1c7998dbce331a4015c7b
Opcode Fuzzy Hash: e92566a1c0c2f114d5f1e51a8750bcc20832d69a3276a1608a3e7850198752b0
Instruction Fuzzy Hash: EFF1883560C341DFC704EF28E88061AFBE1EB8A305F4989ADE4D987292D736D954CB92

Function 00B08C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f640f76e1f85ddf2c69fdbb7be990364f20b7cd8320be40373b9ed984d51278
Instruction ID: 6f19dfbb49b5555d0d7d7882ddad308813ba1c9c73dbe2637a08f67e201b6b52
Opcode Fuzzy Hash: 9f640f76e1f85ddf2c69fdbb7be990364f20b7cd8320be40373b9ed984d51278
Instruction Fuzzy Hash: 2CE1BE31618341CFC704DF28E88066AFBE1FB8A315F4989ACE5D987392D736D950CB92

Function 00ACA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 5f4c8de858f2c4d259e627ba8af3f752d0c8ca93129aaee6a87c0dae8f77b3c5
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 8BF1AE756087458FC724CF29C881B6BFBE2AFE8304F08882DE4D987751E639E945CB52

Function 00B08E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae98e2df1ecca6409beef7b501ccb3d06e532e495622afe1743941ae6d25e71f
Instruction ID: 90afcec1d72b6124eb14fbcb228f961e376ed4d1d451397ddbbad08a4cae2e3d
Opcode Fuzzy Hash: ae98e2df1ecca6409beef7b501ccb3d06e532e495622afe1743941ae6d25e71f
Instruction Fuzzy Hash: 7FD19C3461C340DFD704EF28E89062AFBF5EB8A305F4989ADE4D587292D736D950CB92

Function 00AD4487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91ea7491d1f3185b46e9a34c124ebebb9593caab5819ea7b49363ce9ccf0008
Instruction ID: c151f0ef2935b0cc248c089af82ccb78ab7445129fcd6967d55f6eaf48c1637b
Opcode Fuzzy Hash: d91ea7491d1f3185b46e9a34c124ebebb9593caab5819ea7b49363ce9ccf0008
Instruction Fuzzy Hash: EEE1D0B5601B008FD365CF28D992B97B7E1FF0A705F04886DE4AA87B52EB35B814CB54

Function 00B06CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f0d18ea163a6394abd62462b47fc95225ba9a4d8a5348e5bec6d2de1bffa31
Instruction ID: 80ec23552a689dfea8d856aac1be12e9283755c67e8bc13ba9c23ae2c3f790a9
Opcode Fuzzy Hash: 92f0d18ea163a6394abd62462b47fc95225ba9a4d8a5348e5bec6d2de1bffa31
Instruction Fuzzy Hash: 86D1E236618355CFC724CF38D8C056ABBE2EB89314F498A6CD495C7391EB34DA45CB91

Function 00B07AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78c90a54fa58ef2f3fa141098aa3cb10c82c0e7090698d3b4cb65b6a601f60c
Instruction ID: 9808bf8344d73001124c99f89fb21bdde1585cc2bcd17a83c606868f26ff76f3
Opcode Fuzzy Hash: b78c90a54fa58ef2f3fa141098aa3cb10c82c0e7090698d3b4cb65b6a601f60c
Instruction Fuzzy Hash: BDB11572E483504BE724DA28CC45B6BFBE9EBC5314F0449ACE999973C1EE35EC058792

Function 00ACAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 80cd9042451162d88daa3db7912d7661a1a6184314888f7807763e97e4a69e99
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 18C19AB2A187418FC320CF68DC96BABB7E1BF85318F09492CD1D9C6242E738A155CB16

Function 00AD6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3792b6c0dc4b4c956c764d46c360a71a317b4fe0d82a1568e542642380d12ba9
Instruction ID: 78155eb565df7e0699a0a225cacb279c874b0f5e528bc9210c2e51a070105fe8
Opcode Fuzzy Hash: 3792b6c0dc4b4c956c764d46c360a71a317b4fe0d82a1568e542642380d12ba9
Instruction Fuzzy Hash: F6B111B4600B408BD3258F24DA91B67BBF1AF4A704F14885DE8AB8BB52E735F805CB54

Function 00B07710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e5fa8c712a146726750ebdddfee1c8c1d940a11cc985d7311b338970634a9ea
Instruction ID: 624dd0df001e748e8bccb91b9b6346bd48965fea8e3273545b9aa8beed96b6a5
Opcode Fuzzy Hash: 7e5fa8c712a146726750ebdddfee1c8c1d940a11cc985d7311b338970634a9ea
Instruction Fuzzy Hash: E5917C71A48301ABE720DA15DC81BAFFBE5EB85350F54889CF584973D1EB30E940CB92

Function 00C7F9CC Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32309b37fca9cf8d342be1eea6e8c2f7dc7b9323920f0b6c409fe36a11bf8612
Instruction ID: 064cd5272d8a3bf4c6efc2875f87beae46c996f4f2a0eafa3d0aa836851d1673
Opcode Fuzzy Hash: 32309b37fca9cf8d342be1eea6e8c2f7dc7b9323920f0b6c409fe36a11bf8612
Instruction Fuzzy Hash: CBA18DB3F1122547F3544979CDA83A26683DBD4321F2F82788F496BBCAD97E5C0A5384

Function 00B0A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07197c108abc97fffc3594bdc72ac9ba02576f455ad3f805302e59175c31dc9
Instruction ID: 6ac82bac930e669ee1b8daf648f09fabfd233208ccfc3b709846ad2a2da2b2ba
Opcode Fuzzy Hash: d07197c108abc97fffc3594bdc72ac9ba02576f455ad3f805302e59175c31dc9
Instruction Fuzzy Hash: 46818B342087018BD724DF28D890A2EBBF5FF89740F5589ACE5869B291E731EC10CB92

Function 00AF64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b5d9b8937786436eec36fa209a3ef86c47ea6daa1e49ea510afd17c6e6fc2c
Instruction ID: 6455a45689a82abab8f1c5d54ca8841aeaee34c18c0de5dbb17be6612b576138
Opcode Fuzzy Hash: c8b5d9b8937786436eec36fa209a3ef86c47ea6daa1e49ea510afd17c6e6fc2c
Instruction Fuzzy Hash: 2171C633B69A944BC3149DBC4C823A5AA535BE6334B3DC379FAB4DB3E5D6294C064350

Function 00AE28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb3754543e91d19e7f4ee9db5b5f3c8712f7a1ea653f034d943abbb35f9f727
Instruction ID: bf3f5cb09ba49592a2c2820907d015dbb9d72d9e392d2625ecc655de388712ea
Opcode Fuzzy Hash: cfb3754543e91d19e7f4ee9db5b5f3c8712f7a1ea653f034d943abbb35f9f727
Instruction Fuzzy Hash: 1E6175B44183808BD310AF1AD851B2ABBF5EFA6760F08891CE4C59B261E379D910CB66

Function 00AE7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa2d6e86f148246b9fb3f78475b3bf8d4c81328ad507248cc1f1864cab7e597
Instruction ID: 3f0d123186fc2272a95dbbeaba88d4973b3731b91a9cacc5a63f1b591433ba5d
Opcode Fuzzy Hash: 3aa2d6e86f148246b9fb3f78475b3bf8d4c81328ad507248cc1f1864cab7e597
Instruction Fuzzy Hash: CE51AFB1608244ABDB209B29CC96F7B33B8EF85764F144958F9868B291F375DC05C762

Function 00C2A81E Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78eb7a4b5dccd3d52c1f2f80874951690179e4d90db9bed434383fa8c386549d
Instruction ID: 8cdaf433f58c4dac870f82f458d09b7e20f127813344cda07434e52b699ff057
Opcode Fuzzy Hash: 78eb7a4b5dccd3d52c1f2f80874951690179e4d90db9bed434383fa8c386549d
Instruction Fuzzy Hash: 1B7146F39087149FE304AE29EC8177BB7E5EB48320F1A493DEAC4D3740E97958408687

Function 00AF1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 71b235e03637fd6fc28b1f05c9b96c18429200b4d5d185a3ba5edb431982f3d2
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 7E61BC31609309EBD714DFA9C5C073EBBE2ABC5390F64C92DF6898B255D2B0DD819781

Function 00AF82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fee5667e864d496b18bec56bc46ee8c0a937ff67174a6e43c9308cb12140956
Instruction ID: 02a9ca7983d87e4f8a34a552087790597b724491228b97bb8d6f21ec6cadf83c
Opcode Fuzzy Hash: 1fee5667e864d496b18bec56bc46ee8c0a937ff67174a6e43c9308cb12140956
Instruction Fuzzy Hash: E7613633B5AA954BC32446BC5C553B66A931BE2730F3EC366AAB18F3F4CE6D48014341

Function 00AD42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b84310460e9f98668bfa31571302a51247411d2897b912664de3a9965f0b734
Instruction ID: a468e85a35cbe7a274afb24e965eeca197d8c6bce60a2ae40e7795f6002b3749
Opcode Fuzzy Hash: 7b84310460e9f98668bfa31571302a51247411d2897b912664de3a9965f0b734
Instruction Fuzzy Hash: 6681C2B4810B00AFD360EF39DA47757BEF4AB06601F404A2DE4EA97695E7306459CBE3

Function 00AFE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: dad549f72840f8610a2f0629e7b410d8bbbea172093cf942121bd26af8c7bac8
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 56516CB15083548FE314DF69D49436BBBE1BB85358F044E2DE5E983390E379D6088F92

Function 00B07520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e76049f4dd138fb83d72f3c1b3c0fbccfad26cabbabe9a9278f04b1becb638
Instruction ID: 287564f5563f60b3f5b6b5a04b9fd8115ad39c543bbe2fd763f1cb6ad3a85921
Opcode Fuzzy Hash: 34e76049f4dd138fb83d72f3c1b3c0fbccfad26cabbabe9a9278f04b1becb638
Instruction Fuzzy Hash: D1510531A4C204ABC7159E18CC91B2EFBE6FB85354F688A6CE8D6573D1DA32FC108791

Function 00AC5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8261f6d7cc0ec8e0377d017ba7ec090f19167aea36b686e6f93e5d6f09f71920
Instruction ID: b20f904340973909506c80cd027208cb7af6d641c380e6e1a089b518d3f1ec86
Opcode Fuzzy Hash: 8261f6d7cc0ec8e0377d017ba7ec090f19167aea36b686e6f93e5d6f09f71920
Instruction Fuzzy Hash: C4519075E047049FC714DF28C890E26B7A1FF85364F56466CF8999B352D631EC82CB92

Function 00AEEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebd19746e7ba9557e2ab18a950e8fe88efe2c02533c68d8a64f3dcdeeb5247c
Instruction ID: 4f879093d2a6f15c423f64646f141d9db45ac8fb0827a61f0c7b7e2367f30c78
Opcode Fuzzy Hash: 9ebd19746e7ba9557e2ab18a950e8fe88efe2c02533c68d8a64f3dcdeeb5247c
Instruction Fuzzy Hash: E741CE7890035ADBDF20CF99DC91BADB7B0FF0A340F144548E945AB3A1EB38A951CB91

Function 00B09B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cc7e3416de2f5e7fa3fc61754a21fab57599afa0e57b35d676f9c060817094
Instruction ID: e6410678fe5385fc49b422c69dbe70431dc2bd67f59b35776778dcdae4fb0bab
Opcode Fuzzy Hash: 25cc7e3416de2f5e7fa3fc61754a21fab57599afa0e57b35d676f9c060817094
Instruction Fuzzy Hash: D8419D34608300EBE720DF14D991B2BBBE6EB85750F5488ACF58997292D331EC00CB62

Function 00C90C90 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e2a65594a42b9eb67ac131e5d2589fc9e82a7778e18e9baa32c4a7d86e1af8
Instruction ID: eebd8109d6989462ed1dee2a0ab697a9a730a971a686affd3cdb1d1f9d592b57
Opcode Fuzzy Hash: 49e2a65594a42b9eb67ac131e5d2589fc9e82a7778e18e9baa32c4a7d86e1af8
Instruction Fuzzy Hash: D24158F3D181305BE3182929EC86BABB799DF94230F1B062DEB95E7744D531580082D2

Function 00AD2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8722d34f42f6d3bd5c457f9f6ced0a1c1ac716a493039458ef4512fa0b620303
Instruction ID: 203e7d49beea04059ad5a768158588436791b9fbb7da37dbff03096a599222cd
Opcode Fuzzy Hash: 8722d34f42f6d3bd5c457f9f6ced0a1c1ac716a493039458ef4512fa0b620303
Instruction Fuzzy Hash: CC41E432A083654FD35CCF2A849433ABBE2ABD5300F09C62EE4E687394DA748D45DB81

Function 00AD1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ece949e74140e7b3af476476729df154b42682db74f7a029ce3152c4fa4c79
Instruction ID: ca5c6e54885ffbb545c6d87d21d93ae966c39ecd7104cfa1a64d7a39bf2d0c4a
Opcode Fuzzy Hash: 25ece949e74140e7b3af476476729df154b42682db74f7a029ce3152c4fa4c79
Instruction Fuzzy Hash: E0410F74508380ABD320AB59C884B2EFBF5FB9A344F14491EF6C597392C376E814CB66

Function 00B08D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc1b7469f649993ff11f842abe19da3a33683998748685ff5dc2b68e15ce3e5
Instruction ID: 4fbac1c5afed0392b22758c82e83704396d506ee8a883f19591f9222aa2866c0
Opcode Fuzzy Hash: ffc1b7469f649993ff11f842abe19da3a33683998748685ff5dc2b68e15ce3e5
Instruction Fuzzy Hash: 7341AB316083508FD714AF68C49052EFFE6EF99300F098BADE4D59B2A1DB74DE058B82

Function 00ADD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ef718125666ef90c52c62e7a665097653c982d9cd5ba867fec8443fa6d4b21
Instruction ID: 2de826dbf207714c94262eb4e5cc79210be8fd5730da94cd1e86d650092e9b0d
Opcode Fuzzy Hash: 67ef718125666ef90c52c62e7a665097653c982d9cd5ba867fec8443fa6d4b21
Instruction Fuzzy Hash: 9D41ABB5648381CBD7309F14C885BABB7B0FF963A0F04495DE48A8BBA2E7754941CB53

Function 00AFF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: a0e0c0f8a47cc91883eb794e84fdda60164e1cdd85c07dcec8ec45e08faea17a
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 772107329082284BC3249B99C48153BF7E4EF99704F06863EEAC4A7295E7359C14C7E5

Function 00B067EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b24d1ab3be3241325ba9d461ad0fee7800a7282178f94f61b5c0b003cb46e7
Instruction ID: 3efa5aec480f4595a91ce4d3a697c2b8726c9fe4bbca3e0f38cac3a697c320f4
Opcode Fuzzy Hash: 67b24d1ab3be3241325ba9d461ad0fee7800a7282178f94f61b5c0b003cb46e7
Instruction Fuzzy Hash: 413133705183829AE714CF14C490A2FBFF0EF96784F54984DF4C8AB2A1D738D995CB9A

Function 00AE5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07fe8a1cbe7bf3fa7a067b94b434ccd38088ab68cc7338da17e7626e2c1289a
Instruction ID: 6fe5d425bcd3ea5d64346720c9b0ed614bd8b09f5ba2a91f7495fe16adbcf792
Opcode Fuzzy Hash: f07fe8a1cbe7bf3fa7a067b94b434ccd38088ab68cc7338da17e7626e2c1289a
Instruction Fuzzy Hash: 0821B071908241DBC310AF29D95192BBBF4EF92768F44890CF4D99B292E334CE00CBA3

Function 00AC49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 7418fced3c09fb6bb24f220b93f6969ece2340df506590285632c8dd153d7c4d
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: E431CA316482109FD7149F59D890F2BB7F1EF8C359F1A892DE89A9B241D231DC52CB4A

Function 00B064B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0270035ff5268b0436d2f7c54fba1f003674f8512fc3290d524c18701976c7
Instruction ID: 0603e7896e2deea5e0f279a61bae6c94483646d49c0e8cbd2e8d5a9285e3d05c
Opcode Fuzzy Hash: 4c0270035ff5268b0436d2f7c54fba1f003674f8512fc3290d524c18701976c7
Instruction Fuzzy Hash: 6021737060C200DBD718EF19D880A2EFBE2FB95740F68889CE4C5933A1C730AC61CB62

Function 00B05700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2294397516307f9b8c76f9f9a70888ece9d152448f7a5564133ff0b5c1fa7b2
Instruction ID: 51bd82eed10e939f3871633c5909c0a484eb3589695e9b462795017bf91396f4
Opcode Fuzzy Hash: a2294397516307f9b8c76f9f9a70888ece9d152448f7a5564133ff0b5c1fa7b2
Instruction Fuzzy Hash: 2A11A07191C240EBD311AF28E844A1BBFF9EF8AB10F458868E4C49B291D735D910CB93

Function 00AFB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b57bb84466f8f07d7cf349578063a5a3f9b848e233cc54e33c20acd9a09f1d79
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 4111C233A151D90EC3168E7CC840575BFB31AA7234B698399F4B8DB2D2D7328D8A9364

Function 00AF0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 2238115f1c4c3d912dba5d23239ad1a54738c5499154c2ba1887405c4a9eabca
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: A501D4F1A0030647E720DF9199D0F3BB2A96F80B28F09452CFA4A57303DB71EC06C691

Function 00AED1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42051cbcbc362b3fa80ee0872b35bf8a751c6d66cc9827cb784f41823f63c069
Instruction ID: 02804ace146f7479e1a8d69db5589dca6b8932de5ba0f43e9fad1c5be35e8540
Opcode Fuzzy Hash: 42051cbcbc362b3fa80ee0872b35bf8a751c6d66cc9827cb784f41823f63c069
Instruction Fuzzy Hash: 7E11ECB0408380AFD3109F618584A2FFBE5EBA6754F148C0DF6A49B251C379E819CF56

Function 00AC6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03447301ec48570b4bf1ed14dfffc259364b8d0346e3ad3b858c5ae03b32f63
Instruction ID: d1177f0288c163bd9d48737b99010268ce851cea293945851b20a6cd6e86fe1e
Opcode Fuzzy Hash: b03447301ec48570b4bf1ed14dfffc259364b8d0346e3ad3b858c5ae03b32f63
Instruction Fuzzy Hash: BDF0B43A71921A0BA220CEAAA8C4D3BB3A6D7D9355B15553DEA41D3201DDB2E80691D0

Function 00AFB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00ADC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00ADB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 959b34a8e888b1c680245eed854272159688eedb7dff0890f3e40181517a0e2d
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: BDF0A7F161451097DB22CA559C80B3BBBDCCB96354F1A0427E84657343D2615845C3F5

Function 00AF8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17970000033d2a7b39ddad8dae9a24528c50240c5b5a284bc964cf7576b2c3c5
Instruction ID: 139f3e34a903ab20305f2a8bd453e453b886d120189a354ced12a495062810c6
Opcode Fuzzy Hash: 17970000033d2a7b39ddad8dae9a24528c50240c5b5a284bc964cf7576b2c3c5
Instruction Fuzzy Hash: 0201E4B04107009FD360EF29C445757BFE8EB08714F004A1DE8AECB680D770A5448B82

Function 00B01440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 48a6b1441e06665e76daff333e88fc8009403ae50ebb5f1148150cdb63ee8d4b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 2ED0A7316083214ADF788E1DA40097BFBF0EAC7B11F49999EF586E3298D230DC41C6A9

Function 00AD1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7078ae648d9df255172b88fc30b33188e714e5f7112c8976de8d0ff4a83c0b
Instruction ID: 22089d0534cee3762cfd32c032de5cf9a746957cba5920c401e4a80f259234c8
Opcode Fuzzy Hash: dc7078ae648d9df255172b88fc30b33188e714e5f7112c8976de8d0ff4a83c0b
Instruction Fuzzy Hash: 1BC01234A190028BC204CF00A8A557AB2B8A316308740A02AEA03F3B21CE20D4028909

Function 00B06094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccf80f1df26fcb0b03638be42acd644e47baef41472f81f75475ce200af0baa
Instruction ID: 2062a3eea6dd958247d080e66ed5ad28d352a784c338b733617281ff308f8c4c
Opcode Fuzzy Hash: 5ccf80f1df26fcb0b03638be42acd644e47baef41472f81f75475ce200af0baa
Instruction Fuzzy Hash: 27C04C3465C040869548CE0499514B6E6E69A97A54664F059C80723695E528D512991C

Function 00AD1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd6b0dd89d2cf673fbbb937c60f5809aa5ffce3681448bf5883741fa1f65f10
Instruction ID: 0dbacd97c3a43c9fe873bb6b50024ec34269139c9ba339925c6c2718977be134
Opcode Fuzzy Hash: 4fd6b0dd89d2cf673fbbb937c60f5809aa5ffce3681448bf5883741fa1f65f10
Instruction Fuzzy Hash: AEC04C34B590418AC254CE85A8E1535B2B85316208710303A9A03F7761C960D4058509

Function 00B05FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205303096.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2205139525.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205815331.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206212196.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206281772.0000000000B2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206828526.0000000000B2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209658796.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209720481.0000000000C88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209754407.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209776525.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209800980.0000000000CA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209819367.0000000000CA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209840369.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209886380.0000000000CC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209909054.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209947270.0000000000CDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209973259.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209998635.0000000000D06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210016161.0000000000D0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210038953.0000000000D1B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210063858.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210086224.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210110290.0000000000D24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210130421.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210155566.0000000000D2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210175933.0000000000D37000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210202594.0000000000D3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210222919.0000000000D43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210245726.0000000000D45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210275285.0000000000D4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210294958.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210340268.0000000000D64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210364508.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210446604.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210465720.0000000000DA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210506037.0000000000DBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210531869.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DBE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210557905.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210596615.0000000000DD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210615536.0000000000DD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59486144cd05a344b4fd44c09284d71e7f15c8a59bb98538cdd9ee6cab542b65
Instruction ID: 320523c2949902ea58f87fc483c223a88ada531723144fc7c17245755089cce0
Opcode Fuzzy Hash: 59486144cd05a344b4fd44c09284d71e7f15c8a59bb98538cdd9ee6cab542b65
Instruction Fuzzy Hash: 5FC09224B6C0008BA68CCF18DD519B6F2FA9B8BE18B54F02DC807B3256F938D512860C

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00B050FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 00ACFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00ACD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00B05BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00B0695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00AD049B Relevance: .3, Instructions: 264
COMMON

Function 00AD0228 Relevance: .2, Instructions: 218
COMMON

Function 00B03220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00B03202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON