Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542410
MD5:	c2fd4f13dbcbcdca3d4c63a41bb3d9ba
SHA1:	7bf2a8be1c62b7f00da60c08a3907246b2852283
SHA256:	1a762c8643e53ce22340047e05f9a171546669523a2e1166a8dc5cf59d626575
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3040 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C2FD4F13DBCBCDCA3D4C63A41BB3D9BA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["licendfilteo.site", "spirittunek.store", "dissapoiznw.store", "studennotediw.store", "eaglepawnoy.store", "bathdoomgaz.store", "mobbipenju.store", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:12.025566+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	54509	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:11.821142+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	57151	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:11.993335+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	54597	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:11.910630+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	55270	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:12.055107+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	65025	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:11.888920+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	63649	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:12.038171+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	64206	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:12.010457+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	52767	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T21:52:13.666681+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49719	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com:443/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.3040.1.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["licendfilteo.site", "spirittunek.store", "dissapoiznw.store", "studennotediw.store", "eaglepawnoy.store", "bathdoomgaz.store", "mobbipenju.store", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49719 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00DCD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00DCD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00E063B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00E099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_00E0695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_00DCFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_00DD0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	1_2_00E06094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00E04040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	1_2_00DC1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	1_2_00DFF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00DD6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00DED1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00DD42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00DE2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_00DE2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	1_2_00DCA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00E064B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00DDD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_00E01440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00DEC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_00DDB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00DEE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	1_2_00DC8590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	1_2_00E07520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00DE9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00DD6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00DFB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00DEE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_00E067EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00DED7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00E05700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00E07710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00DE28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00DC49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_00DDD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_00E03920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00DD1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00DC5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00E04A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00DD1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00DD1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00DD3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00DF0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00E09B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	1_2_00DDDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	1_2_00DDDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00E09CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00E09CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_00DECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00DECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_00DECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00DEAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	1_2_00DEAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_00DEEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00DE7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	1_2_00DFFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00E08D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	1_2_00DEFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00DEDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00DD1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	1_2_00DD6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	1_2_00DCBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	1_2_00DC6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	1_2_00DEAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00DE5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00DE7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	1_2_00DD4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	1_2_00DDFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	1_2_00DC8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_00E07FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00E07FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	1_2_00E05FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00DD6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00DFFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00DE9F62

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:57151 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:63649 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:65025 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:55270 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:64206 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:54509 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:52767 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:54597 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49719 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: clearancek.site

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=24617773c397a043c9b1ebce; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35741Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 25 Oct 2024 19:52:13 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.s
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8d
Source: file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apiX
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000001.00000002.2238576561.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/apiy
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/K
Source: file.exe, 00000001.00000002.2238427249.0000000001488000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236484730.0000000001487000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiA
Source: file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiK
Source: file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/t
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000001.00000003.2236374585.0000000001466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/2
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/L
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238156506.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000001.00000002.2238292713.0000000001466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000001.00000002.2238576561.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000001.00000002.2238576561.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000001.00000003.2236374585.0000000001466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900r
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec81
Source: file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49719 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DD0228	1_2_00DD0228
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E0A0D0	1_2_00E0A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F010C1	1_2_00F010C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EC10DB	1_2_00EC10DB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E04040	1_2_00E04040
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109D1A5	1_2_0109D1A5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048	1_2_00FA0048
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC1000	1_2_00DC1000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DD2030	1_2_00DD2030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC71F0	1_2_00DC71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DCE1A0	1_2_00DCE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC5160	1_2_00DC5160
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DF82D0	1_2_00DF82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DF12D0	1_2_00DF12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC12F7	1_2_00DC12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EB42DE	1_2_00EB42DE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F9428F	1_2_00F9428F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F8A239	1_2_00F8A239
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010BB3D2	1_2_010BB3D2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F993D9	1_2_00F993D9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DF23E0	1_2_00DF23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DCB3A0	1_2_00DCB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC13A3	1_2_00DC13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DCA300	1_2_00DCA300
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DF64F0	1_2_00DF64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DD049B	1_2_00DD049B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DD4487	1_2_00DD4487
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DEC470	1_2_00DEC470
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DDC5F0	1_2_00DDC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC8590	1_2_00DC8590
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F9E5A0	1_2_00F9E5A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F8F590	1_2_00F8F590
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC35B0	1_2_00DC35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E086F0	1_2_00E086F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC164F	1_2_00DC164F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E08652	1_2_00E08652
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E6762B	1_2_00E6762B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F8D620	1_2_00F8D620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DFF620	1_2_00DFF620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EE177A	1_2_00EE177A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DFB8C0	1_2_00DFB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DFE8A0	1_2_00DFE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DCA850	1_2_00DCA850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DF1860	1_2_00DF1860
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E089A0	1_2_00E089A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DE098B	1_2_00DE098B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F0C991	1_2_00F0C991
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F9C99C	1_2_00F9C99C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E07AB0	1_2_00E07AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E08A80	1_2_00E08A80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E04A40	1_2_00E04A40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC7BF0	1_2_00DC7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DDDB6F	1_2_00DDDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F97B15	1_2_00F97B15
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DECCD0	1_2_00DECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E06CBF	1_2_00E06CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E08C02	1_2_00E08C02
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F90D7B	1_2_00F90D7B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DE8D62	1_2_00DE8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DEFD10	1_2_00DEFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DEDD29	1_2_00DEDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DD6EBF	1_2_00DD6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DCBEB0	1_2_00DCBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F95E7A	1_2_00F95E7A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DEAE57	1_2_00DEAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E08E70	1_2_00E08E70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DD4E2A	1_2_00DD4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC8FD0	1_2_00DC8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E07FC0	1_2_00E07FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DCAF10	1_2_00DCAF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00DCCAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00DDD300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9995423370462047

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/1

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00DF8220 CoCreateInstance,

1_2_00DF8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2974720 > 1048576

Source: file.exe

Static PE information: Raw size of wovnjubk is bigger than: 0x100000 < 0x2ace00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.dc0000.0.unpack :EW;.rsrc :W;.idata :W;wovnjubk:EW;yaqwutur:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;wovnjubk:EW;yaqwutur:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2de644 should be: 0x2e0d0f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: wovnjubk
Source: file.exe	Static PE information: section name: yaqwutur
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E8C0C0 push ebx; mov dword ptr [esp], edi	1_2_00E8C0E1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103E128 push ebx; mov dword ptr [esp], 73E562B8h	1_2_0103E14D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0103E128 push 18F90B00h; mov dword ptr [esp], edi	1_2_0103E1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F010C1 push 14B030A6h; mov dword ptr [esp], eax	1_2_00F010E5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F010C1 push 2E77470Ah; mov dword ptr [esp], edx	1_2_00F0112E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F010C1 push edx; mov dword ptr [esp], ebx	1_2_00F0113B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F010C1 push edi; mov dword ptr [esp], 3EF1D884h	1_2_00F01154
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EC10DB push 05FD7B34h; mov dword ptr [esp], ecx	1_2_00EC118E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EC10DB push eax; mov dword ptr [esp], 20C3F244h	1_2_00EC1192
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01084146 push ebx; mov dword ptr [esp], 675E12EFh	1_2_01084584
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FBA091 push 03A4CDC8h; mov dword ptr [esp], ebp	1_2_00FBA0A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FBA091 push 6BAEE062h; mov dword ptr [esp], ebx	1_2_00FBA0B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CD1A7 push eax; mov dword ptr [esp], 49802D71h	1_2_010CD1EE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CD1A7 push 730724B5h; mov dword ptr [esp], eax	1_2_010CD2AE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010CD1A7 push ecx; mov dword ptr [esp], edi	1_2_010CD2EC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109D1A5 push 212A5600h; mov dword ptr [esp], ebx	1_2_0109D1AE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109D1A5 push esi; mov dword ptr [esp], 3F3FE917h	1_2_0109D259
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109D1A5 push 37E7B2A2h; mov dword ptr [esp], ebx	1_2_0109D290
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0109D1A5 push eax; mov dword ptr [esp], ecx	1_2_0109D314
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push 0BF648E0h; mov dword ptr [esp], edi	1_2_00FA005B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push eax; mov dword ptr [esp], edi	1_2_00FA0082
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push edx; mov dword ptr [esp], ebp	1_2_00FA00D8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push 68BB3300h; mov dword ptr [esp], edx	1_2_00FA00F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push ecx; mov dword ptr [esp], esi	1_2_00FA02A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push ecx; mov dword ptr [esp], 7F3E1CCEh	1_2_00FA02AB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push 1DDC8A05h; mov dword ptr [esp], eax	1_2_00FA02D3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push ecx; mov dword ptr [esp], ebx	1_2_00FA0386
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push edi; mov dword ptr [esp], ecx	1_2_00FA038A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push 78D8F5C8h; mov dword ptr [esp], edi	1_2_00FA03A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push 02AC5F00h; mov dword ptr [esp], edi	1_2_00FA03E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FA0048 push 32831B3Ch; mov dword ptr [esp], ebx	1_2_00FA0488

Source: file.exe

Static PE information: section name: entropy: 7.980557470764062

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2441B second address: E2442B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jng 00007FE4ED52DD0Eh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E23C9B second address: E23CA5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE4ECD4F26Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA58A5 second address: FA58B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jl 00007FE4ED52DD06h 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA58B6 second address: FA58BC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5A2B second address: FA5A36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE4ED52DD06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5A36 second address: FA5A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FE4ECD4F272h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5EF6 second address: FA5F01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5F01 second address: FA5F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5F06 second address: FA5F0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5F0B second address: FA5F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007FE4ECD4F266h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jbe 00007FE4ECD4F266h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6077 second address: FA6095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE4ED52DD17h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6095 second address: FA6099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9EF6 second address: FA9F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 xor dword ptr [esp], 0C3C9C4Ch 0x0000000c mov dword ptr [ebp+122D3563h], ebx 0x00000012 lea ebx, dword ptr [ebp+12459CEFh] 0x00000018 call 00007FE4ED52DD0Dh 0x0000001d pop edi 0x0000001e jmp 00007FE4ED52DD17h 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007FE4ED52DD12h 0x0000002b push edx 0x0000002c pop edx 0x0000002d popad 0x0000002e pop eax 0x0000002f push eax 0x00000030 pushad 0x00000031 jmp 00007FE4ED52DD11h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9F63 second address: FA9F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9FC8 second address: FA9FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9FCE second address: FA9FF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F26Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007FE4ECD4F26Dh 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9FF2 second address: FA9FF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9FF8 second address: FA9FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9FFC second address: FAA031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sbb edi, 12D7539Dh 0x0000000f push 00000000h 0x00000011 jl 00007FE4ED52DD08h 0x00000017 push E3D437ADh 0x0000001c pushad 0x0000001d push edx 0x0000001e jmp 00007FE4ED52DD0Ch 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jo 00007FE4ED52DD06h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA031 second address: FAA035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA035 second address: FAA098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 1C2BC8D3h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FE4ED52DD08h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 stc 0x00000029 push eax 0x0000002a pop edx 0x0000002b push 00000003h 0x0000002d and cx, 13BDh 0x00000032 push 00000000h 0x00000034 clc 0x00000035 push 00000003h 0x00000037 call 00007FE4ED52DD0Bh 0x0000003c mov cx, dx 0x0000003f pop edx 0x00000040 call 00007FE4ED52DD09h 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FE4ED52DD0Eh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA098 second address: FAA0BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE4ECD4F277h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA0BA second address: FAA0F5 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4ED52DD08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f jmp 00007FE4ED52DD12h 0x00000014 pop edx 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007FE4ED52DD0Ch 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA0F5 second address: FAA0F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA0F9 second address: FAA124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b xor di, 8E00h 0x00000010 lea ebx, dword ptr [ebp+12459CF8h] 0x00000016 or ch, 00000052h 0x00000019 mov edi, dword ptr [ebp+122D2F40h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA124 second address: FAA128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA25A second address: FAA260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7ED6 second address: FC7EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F276h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7EF2 second address: FC7F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pushad 0x0000000a jl 00007FE4ED52DD06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7F04 second address: FC7F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FE4ECD4F26Ch 0x00000010 jnl 00007FE4ECD4F266h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE4ECD4F270h 0x0000001d jl 00007FE4ECD4F266h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7F32 second address: FC7F3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jg 00007FE4ED52DD06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC809D second address: FC80AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE4ECD4F266h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC820D second address: FC8244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD0Ch 0x00000009 jmp 00007FE4ED52DD17h 0x0000000e popad 0x0000000f jmp 00007FE4ED52DD0Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8244 second address: FC8271 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE4ECD4F283h 0x00000008 jmp 00007FE4ECD4F277h 0x0000000d jg 00007FE4ECD4F266h 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007FE4ECD4F266h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC877E second address: FC87A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FE4ED52DD0Ch 0x0000000f push edx 0x00000010 jmp 00007FE4ED52DD0Ch 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC87A1 second address: FC87BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ECD4F277h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC87BC second address: FC87C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8A37 second address: FC8A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007FE4ECD4F277h 0x0000000f jnl 00007FE4ECD4F266h 0x00000015 popad 0x00000016 pop eax 0x00000017 pushad 0x00000018 jne 00007FE4ECD4F26Ch 0x0000001e pushad 0x0000001f jne 00007FE4ECD4F266h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8EA1 second address: FC8EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC96A7 second address: FC96C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jo 00007FE4ECD4F279h 0x0000000b jmp 00007FE4ECD4F273h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC96C5 second address: FC96CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC96CB second address: FC96D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCF1E second address: FCCF22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBA22 second address: FCBA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0A4B second address: FD0A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD13h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0A64 second address: FD0A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FE4ECD4F272h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0A71 second address: FD0A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95933 second address: F95939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95939 second address: F9593D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5576 second address: FD557A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD557A second address: FD558A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD0Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD558A second address: FD5595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE4ECD4F266h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5595 second address: FD559E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4CD0 second address: FD4D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F275h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c js 00007FE4ECD4F28Fh 0x00000012 jmp 00007FE4ECD4F275h 0x00000017 jmp 00007FE4ECD4F274h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD52D3 second address: FD52F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FE4ED52DD06h 0x0000000b jmp 00007FE4ED52DD10h 0x00000010 jnl 00007FE4ED52DD06h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD52F9 second address: FD52FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD542B second address: FD542F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5F3C second address: FD5F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD61F0 second address: FD61F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6359 second address: FD6363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE4ECD4F266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6490 second address: FD649A instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4ED52DD0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6A78 second address: FD6AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FE4ECD4F274h 0x0000000b pop edx 0x0000000c xchg eax, ebx 0x0000000d xor di, 0FCCh 0x00000012 jmp 00007FE4ECD4F275h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007FE4ECD4F266h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6AB9 second address: FD6ABF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6D35 second address: FD6D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ECD4F270h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6E0C second address: FD6E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6E11 second address: FD6E32 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE4ECD4F26Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE4ECD4F26Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD701D second address: FD7023 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7023 second address: FD702A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD800C second address: FD8010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD80B9 second address: FD80BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD80BD second address: FD80C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8FAB second address: FD9012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FE4ECD4F268h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007FE4ECD4F268h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f mov edi, dword ptr [ebp+122D214Eh] 0x00000045 push 00000000h 0x00000047 cmc 0x00000048 push eax 0x00000049 js 00007FE4ECD4F27Eh 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FE4ECD4F26Ch 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA662 second address: FDA66C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FE4ED52DD06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA414 second address: FDA41A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA66C second address: FDA696 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4ED52DD11h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA41A second address: FDA423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA423 second address: FDA427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF4AB second address: FDF4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FE4ECD4F279h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB7AE second address: FDB7DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jo 00007FE4ED52DD06h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF4D2 second address: FDF56F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d ja 00007FE4ECD4F289h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FE4ECD4F268h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f and edi, 5FC1F87Ah 0x00000035 xchg eax, esi 0x00000036 pushad 0x00000037 pushad 0x00000038 push eax 0x00000039 pop eax 0x0000003a jnc 00007FE4ECD4F266h 0x00000040 popad 0x00000041 jmp 00007FE4ECD4F272h 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FE4ECD4F279h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB7DB second address: FDB7DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2C2C second address: FE2C36 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE4ECD4F266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2C36 second address: FE2CAF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, dword ptr [ebp+122D35D1h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FE4ED52DD08h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d xor dword ptr [ebp+1245746Fh], ecx 0x00000033 mov di, 2806h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007FE4ED52DD08h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 00000014h 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 jng 00007FE4ED52DD10h 0x00000059 pushad 0x0000005a mov dword ptr [ebp+122D28E3h], edx 0x00000060 mov bl, dh 0x00000062 popad 0x00000063 push eax 0x00000064 pushad 0x00000065 jp 00007FE4ED52DD08h 0x0000006b pushad 0x0000006c popad 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4CA7 second address: FE4CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D32BFh] 0x00000012 push 00000000h 0x00000014 call 00007FE4ECD4F26Fh 0x00000019 movsx ebx, ax 0x0000001c pop edi 0x0000001d mov dword ptr [ebp+122D3563h], eax 0x00000023 push 00000000h 0x00000025 mov di, si 0x00000028 xchg eax, esi 0x00000029 push ecx 0x0000002a jnl 00007FE4ECD4F26Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4CF3 second address: FE4D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4ED52DD15h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5D3F second address: FE5D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5D43 second address: FE5D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jc 00007FE4ED52DD14h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7BAD second address: FE7BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7CF4 second address: FE7CFA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7CFA second address: FE7D04 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4ECD4F26Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7D04 second address: FE7D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jno 00007FE4ED52DD06h 0x00000010 jmp 00007FE4ED52DD0Ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907C3 second address: F907C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907C9 second address: F907D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FE4ED52DD06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907D5 second address: F907D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F907D9 second address: F90802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE4ED52DD10h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90802 second address: F90822 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4ECD4F266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE4ECD4F276h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8BAC second address: FE8BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FE4ED52DD0Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FE4ED52DD06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8BC6 second address: FE8BCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8BCA second address: FE8C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov bh, 9Dh 0x0000000a push dword ptr fs:[00000000h] 0x00000011 movzx edi, di 0x00000014 mov dword ptr fs:[00000000h], esp 0x0000001b pushad 0x0000001c mov edi, dword ptr [ebp+122D22B2h] 0x00000022 popad 0x00000023 mov eax, dword ptr [ebp+122D14A1h] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FE4ED52DD08h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 sub dword ptr [ebp+122D1DBFh], esi 0x00000049 mov dword ptr [ebp+122D370Eh], eax 0x0000004f push FFFFFFFFh 0x00000051 sbb bx, 0D66h 0x00000056 push eax 0x00000057 pushad 0x00000058 push esi 0x00000059 jmp 00007FE4ED52DD18h 0x0000005e pop esi 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC3B4 second address: FEC3D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F26Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FE4ECD4F266h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED2EA second address: FED307 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE175 second address: FEE185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F26Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED307 second address: FED30B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE185 second address: FEE226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2BB2h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FE4ECD4F268h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c call 00007FE4ECD4F275h 0x00000031 mov ebx, dword ptr [ebp+122D2C2Eh] 0x00000037 pop ebx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007FE4ECD4F268h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 xchg eax, esi 0x00000055 je 00007FE4ECD4F27Eh 0x0000005b jmp 00007FE4ECD4F278h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE226 second address: FEE22A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED30B second address: FED349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+12460909h] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 movsx edi, dx 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f and ebx, 0535883Dh 0x00000025 mov eax, dword ptr [ebp+122D034Dh] 0x0000002b xor ebx, dword ptr [ebp+122D2DAAh] 0x00000031 push FFFFFFFFh 0x00000033 mov ebx, 7D926941h 0x00000038 nop 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED349 second address: FED34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE22A second address: FEE22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED34D second address: FED35F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE4ED52DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FE4ED52DD06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE22E second address: FEE234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED35F second address: FED36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED36C second address: FED370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE3B6 second address: FEE3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02C2 second address: FF02C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02C6 second address: FF02CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02CA second address: FF02F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 jmp 00007FE4ECD4F272h 0x00000015 pop edi 0x00000016 pushad 0x00000017 jc 00007FE4ECD4F266h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0570 second address: FF0574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0574 second address: FF057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1415 second address: FF1429 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE4ED52DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1429 second address: FF143E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4ECD4F270h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D1B5 second address: F8D1B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D1B9 second address: F8D1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D1BF second address: F8D1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D1C8 second address: F8D1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D1CE second address: F8D1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA283 second address: FFA288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA288 second address: FFA28D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA28D second address: FFA2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F273h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FE4ECD4F266h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA3E4 second address: FFA3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA3EA second address: FFA434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE4ECD4F277h 0x0000000a pushad 0x0000000b jnc 00007FE4ECD4F266h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FE4ECD4F26Eh 0x00000018 popad 0x00000019 jmp 00007FE4ECD4F26Bh 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jl 00007FE4ECD4F266h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA434 second address: FFA448 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FE4ED52DD0Ch 0x0000000e jng 00007FE4ED52DD06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE4DE second address: FFE4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE4E3 second address: FFE4E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE4E8 second address: FFE52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FE4ECD4F26Fh 0x00000010 mov eax, dword ptr [eax] 0x00000012 jnl 00007FE4ECD4F278h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jg 00007FE4ECD4F268h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE52A second address: FFE530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE530 second address: FFE534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE534 second address: FFE538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE5B1 second address: FFE5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE5B7 second address: FFE5BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE6AB second address: FFE6C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ECD4F276h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE6C5 second address: FFE6F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push esi 0x0000000e ja 00007FE4ED52DD0Ch 0x00000014 je 00007FE4ED52DD06h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE6F2 second address: FFE6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE6F8 second address: FFE6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE6FD second address: FFE702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10046B3 second address: 10046B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10046B7 second address: 10046DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FE4ECD4F266h 0x00000010 jmp 00007FE4ECD4F277h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10046DE second address: 10046F8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4ED52DD06h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4ED52DD0Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10046F8 second address: 10046FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004D84 second address: 1004D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004D8E second address: 1004D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005078 second address: 100507C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100507C second address: 1005089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005089 second address: 100508E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100508E second address: 1005093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10097EF second address: 100981E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4ED52DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FE4ED52DD0Eh 0x00000010 jnp 00007FE4ED52DD06h 0x00000016 jnc 00007FE4ED52DD06h 0x0000001c popad 0x0000001d pushad 0x0000001e jne 00007FE4ED52DD06h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DB19 second address: 100DB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DB1D second address: 100DB27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DB27 second address: 100DB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F26Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD53B second address: FDD53F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD53F second address: FDD544 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD75B second address: FDD761 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD761 second address: FDD76B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE4ECD4F266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDB98 second address: FDDB9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDB9C second address: FDDBB1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FE4ECD4F268h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDBB1 second address: FDDC12 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FE4ED52DD08h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 stc 0x00000024 call 00007FE4ED52DD09h 0x00000029 pushad 0x0000002a jne 00007FE4ED52DD11h 0x00000030 jne 00007FE4ED52DD0Ch 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jne 00007FE4ED52DD0Ch 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDC12 second address: FDDC3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnp 00007FE4ECD4F266h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jnl 00007FE4ECD4F268h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE4ECD4F270h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDDFF second address: FDDE26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FE4ED52DD08h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDE26 second address: FDDE61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F274h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a or di, 5BF3h 0x0000000f push eax 0x00000010 pushad 0x00000011 jng 00007FE4ECD4F277h 0x00000017 jmp 00007FE4ECD4F271h 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDE61 second address: FDDE65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF6C second address: FDDF72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF72 second address: FDDFB5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE4ED52DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jp 00007FE4ED52DD27h 0x00000016 pushad 0x00000017 jns 00007FE4ED52DD06h 0x0000001d jmp 00007FE4ED52DD19h 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 jo 00007FE4ED52DD10h 0x0000002b push eax 0x0000002c push edx 0x0000002d push edi 0x0000002e pop edi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE0A3 second address: FDE0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE0B0 second address: FDE0B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE0B6 second address: FDE0BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE64F second address: FDE655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE655 second address: FDE686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FE4ECD4F275h 0x0000000c nop 0x0000000d xor dx, 460Ah 0x00000012 push 0000001Eh 0x00000014 mov edx, dword ptr [ebp+122D2CCAh] 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100CDF0 second address: 100CDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100CDF4 second address: 100CE03 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE4ECD4F266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100CE03 second address: 100CE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100CE09 second address: 100CE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D399 second address: 100D3B5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE4ED52DD06h 0x00000008 jc 00007FE4ED52DD06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jp 00007FE4ED52DD0Ch 0x00000016 jns 00007FE4ED52DD06h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D3B5 second address: 100D3BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D3BD second address: 100D3E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4ED52DD12h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D3E4 second address: 100D410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE4ECD4F276h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE4ECD4F26Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D410 second address: 100D414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D574 second address: 100D57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D57A second address: 100D59E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4ED52DD13h 0x0000000e je 00007FE4ED52DD12h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D59E second address: 100D5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE4ECD4F266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D700 second address: 100D706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D706 second address: 100D70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011FBE second address: 1011FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE4ED52DD06h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011FC9 second address: 1011FCE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10122B9 second address: 10122C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FE4ED52DD06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10122C5 second address: 10122C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10122C9 second address: 10122CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10122CF second address: 10122D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10127D6 second address: 10127DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012AF2 second address: 1012AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012AF9 second address: 1012B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012B02 second address: 1012B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F274h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012B1A second address: 1012B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012DA7 second address: 1012DCF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4ECD4F277h 0x0000000e push ebx 0x0000000f jnp 00007FE4ECD4F266h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012DCF second address: 1012DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FE4ED52DD06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10131A9 second address: 10131BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE4ECD4F266h 0x0000000a jmp 00007FE4ECD4F26Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10189C3 second address: 10189E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD17h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10189E0 second address: 1018A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE4ECD4F266h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007FE4ECD4F266h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jo 00007FE4ECD4F266h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017A0E second address: 1017A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017A13 second address: 1017A1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017A1C second address: 1017A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE4ED52DD19h 0x0000000c jmp 00007FE4ED52DD12h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017CF3 second address: 1017D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE4ECD4F279h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D19 second address: 1017D1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E45 second address: 1017E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E4E second address: 1017E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ED52DD0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E5F second address: 1017E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E63 second address: 1017E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FE4ED52DD08h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E79 second address: 1017E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E7D second address: 1017E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101749A second address: 101749E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101749E second address: 10174B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE4ED52DD0Ah 0x0000000c ja 00007FE4ED52DD06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101869A second address: 10186BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10186BA second address: 10186BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10186BE second address: 10186C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1612 second address: FA1618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EB4E second address: 101EB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F26Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EB66 second address: 101EB70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE4ED52DD06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EB70 second address: 101EB98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007FE4ECD4F286h 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FE4ECD4F274h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020E4F second address: 1020E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020E53 second address: 1020E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020E57 second address: 1020E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD0Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007FE4ED52DD12h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020B17 second address: 1020B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020B20 second address: 1020B3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020B3C second address: 1020B46 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B32 second address: 1025B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD11h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B47 second address: 1025B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B4B second address: 1025B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B51 second address: 1025B70 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4ECD4F279h 0x00000008 jmp 00007FE4ECD4F273h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B70 second address: 1025B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B74 second address: 1025B81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025B81 second address: 1025B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026127 second address: 102612B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102612B second address: 102612F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10262A7 second address: 10262AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10262AE second address: 10262B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10262B6 second address: 10262C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE4ECD4F266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A61A second address: 102A61E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A61E second address: 102A63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jne 00007FE4ECD4F266h 0x0000000f jmp 00007FE4ECD4F26Ah 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A63A second address: 102A64B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ED52DD0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AB01 second address: 102AB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE4ECD4F26Ch 0x0000000a jl 00007FE4ECD4F266h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AC98 second address: 102AC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE434 second address: FDE438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE500 second address: FDE518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE518 second address: FDE51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE51C second address: FDE520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AF91 second address: 102AF97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AF97 second address: 102AFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102ED05 second address: 102ED0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102ED0B second address: 102ED41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD16h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c jmp 00007FE4ED52DD0Bh 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jns 00007FE4ED52DD06h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102ED41 second address: 102ED67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007FE4ECD4F266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE4ECD4F276h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E66F second address: 102E673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E673 second address: 102E69C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F271h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e js 00007FE4ECD4F266h 0x00000014 jng 00007FE4ECD4F266h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E69C second address: 102E6A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035C31 second address: 1035C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034286 second address: 103428C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103428C second address: 1034292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034292 second address: 10342AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE4ED52DD06h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007FE4ED52DD0Ch 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10342AB second address: 10342B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10342B0 second address: 10342BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FE4ED52DD06h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10342BF second address: 10342C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10342C3 second address: 10342C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10342C9 second address: 10342EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE4ECD4F276h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034844 second address: 103484A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103534A second address: 103536D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FE4ECD4F266h 0x0000000c popad 0x0000000d jmp 00007FE4ECD4F276h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103536D second address: 1035379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007FE4ED52DD06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035379 second address: 103537D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103537D second address: 1035383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035383 second address: 1035391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FE4ECD4F266h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EA60 second address: 103EA74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FE4ED52DD06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 push edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EA74 second address: 103EA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE4ECD4F266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103DCCC second address: 103DCD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E4D8 second address: 103E4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E65D second address: 103E677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FE4ED52DD14h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E677 second address: 103E67B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E67B second address: 103E689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FE4ED52DD06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E689 second address: 103E68D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104997D second address: 10499A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ED52DD16h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jnc 00007FE4ED52DD06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10499A1 second address: 10499AB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE4ECD4F266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10499AB second address: 10499CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4ED52DD0Ch 0x0000000e jmp 00007FE4ED52DD0Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047B72 second address: 1047B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FE4ECD4F26Eh 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047B9D second address: 1047BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE4ED52DD06h 0x0000000a pop edi 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FE4ED52DD06h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047CF4 second address: 1047CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048682 second address: 1048693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FE4ED52DD0Ah 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10487E6 second address: 10487EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10487EA second address: 10487F4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE4ED52DD0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497CC second address: 10497D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497D2 second address: 10497D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497D7 second address: 10497DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497DE second address: 104980C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE4ED52DD06h 0x0000000a popad 0x0000000b je 00007FE4ED52DD19h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104980C second address: 1049811 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049811 second address: 1049817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047705 second address: 1047723 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE4ECD4F266h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d pushad 0x0000000e jng 00007FE4ECD4F268h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FE4ECD4F266h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047723 second address: 104772C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FBCB second address: 104FBD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105DA89 second address: 105DA8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105DA8F second address: 105DA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060034 second address: 106003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106003B second address: 1060040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10635DA second address: 10635DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106810A second address: 106810E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106810E second address: 1068112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068112 second address: 1068118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BF93 second address: 106BF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BF97 second address: 106BF9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E09F second address: 106E0B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD11h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DEC7 second address: 106DECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DECB second address: 106DECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DECF second address: 106DF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE4ECD4F276h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE4ECD4F26Ch 0x00000016 jnc 00007FE4ECD4F266h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DF03 second address: 106DF1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE4ED52DD11h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DF1E second address: 106DF22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078B26 second address: 1078B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007FE4ED52DD06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078C8D second address: 1078C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079333 second address: 107933F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnc 00007FE4ED52DD06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107933F second address: 107935D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4ECD4F271h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jc 00007FE4ECD4F266h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080001 second address: 1080012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FE4ED52DD0Ch 0x0000000b jl 00007FE4ED52DD06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080012 second address: 1080018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FBD7 second address: 107FBDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FD28 second address: 107FD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10816DC second address: 10816E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007FE4ED52DD06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082D30 second address: 1082D3F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE4ECD4F266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082D3F second address: 1082D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FE4ED52DD08h 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007FE4ED52DD06h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CE73 second address: 109CE77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CE77 second address: 109CE97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b jbe 00007FE4ED52DD06h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE4ED52DD0Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CE97 second address: 109CE9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CE9D second address: 109CEB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD18h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E972 second address: 109E97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8839 second address: 10B8858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD19h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8A05 second address: 10B8A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE4ECD4F266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8C7A second address: 10B8C8A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FE4ED52DD06h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8C8A second address: 10B8CAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F277h 0x00000007 jno 00007FE4ECD4F266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CAF second address: 10B8CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9103 second address: 10B9122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F274h 0x00000009 ja 00007FE4ECD4F266h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9122 second address: 10B9137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ED52DD11h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9656 second address: 10B965B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B965B second address: 10B9693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD15h 0x00000007 jmp 00007FE4ED52DD11h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 jl 00007FE4ED52DD06h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB057 second address: 10BB061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE4ECD4F266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB061 second address: 10BB065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB065 second address: 10BB06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB06B second address: 10BB095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ED52DD11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FE4ED52DD0Ch 0x00000011 jnc 00007FE4ED52DD06h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB095 second address: 10BB09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C462 second address: F9C468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C468 second address: F9C47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE4ECD4F266h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jp 00007FE4ECD4F266h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C47E second address: F9C489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C489 second address: F9C4CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE4ECD4F273h 0x00000010 ja 00007FE4ECD4F286h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF079 second address: 10BF09C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FE4ED52DD16h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF302 second address: 10BF30C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE4ECD4F266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF505 second address: 10BF50F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4ED52DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0712 second address: 10C0729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F271h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0729 second address: 10C0732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2267 second address: 10C2283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4ECD4F276h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2283 second address: 10C22BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FE4ED52DD1Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE4ED52DD16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C22BA second address: 10C22BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C22BE second address: 10C22DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE4ED52DD12h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C22DC second address: 10C22E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170CE2 second address: 5170D6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ch 0x00000005 pushfd 0x00000006 jmp 00007FE4ED52DD11h 0x0000000b xor si, 5AA6h 0x00000010 jmp 00007FE4ED52DD11h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ecx, dword ptr [eax+00000FDCh] 0x0000001f pushad 0x00000020 mov dx, ax 0x00000023 jmp 00007FE4ED52DD18h 0x00000028 popad 0x00000029 test ecx, ecx 0x0000002b jmp 00007FE4ED52DD10h 0x00000030 jns 00007FE4ED52DD4Dh 0x00000036 jmp 00007FE4ED52DD10h 0x0000003b add eax, ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FE4ED52DD0Ah 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170D6E second address: 5170D72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170D72 second address: 5170D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170D78 second address: 5170D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4ECD4F26Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170D89 second address: 5170D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8C24 second address: FD8C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4ECD4F276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jng 00007FE4ECD4F266h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8C49 second address: FD8C53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE4ED52DD06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8C53 second address: FD8C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E23BDD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E23CBD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FCB80F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FDD6DA instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5012	Thread sleep time: -90000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5012	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000002.2238156506.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000001.00000003.2236374585.0000000001466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E05BB0 LdrInitializeThunk,

1_2_00E05BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: mobbipenju.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store

Source: file.exe, 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: d?Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
sergei-esenin.com	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
studennotediw.store	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
eaglepawnoy.store	true	unknown
bathdoomgaz.store	true	unknown
clearancek.site	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eaglepawnoy.store:443/apiy	file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900r	file.exe, 00000001.00000003.2236374585.0000000001466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001466000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://licendfilteo.site:443/api	file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000001.00000002.2238576561.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/t	file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/about/	file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/K	file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/2	file.exe, 00000001.00000003.2236374585.0000000001466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001466000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8d	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238156506.0000000001446000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dissapoiznw.store:443/api	file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiA	file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/L	file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiK	file.exe, 00000001.00000003.2236484730.000000000148A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238427249.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/	file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/apiX	file.exe, 00000001.00000003.2236374585.0000000001450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238292713.0000000001450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2238516839.00000000014D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec81	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236141261.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000001.00000002.2238576561.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236082790.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236374585.0000000001449000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236125682.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2236323974.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542410
Start date and time:	2024-10-25 21:51:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:52:10	API Interceptor	4x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	23.38.98.201
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Fanduel CO Player Location Check F.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	1.zip	Get hash	malicious	Unknown	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.DropperX-gen.11055.6641.exe	Get hash	malicious	BlackMoon	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.DropperX-gen.11055.6641.exe	Get hash	malicious	BlackMoon	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5036270157381795
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'974'720 bytes
MD5:	c2fd4f13dbcbcdca3d4c63a41bb3d9ba
SHA1:	7bf2a8be1c62b7f00da60c08a3907246b2852283
SHA256:	1a762c8643e53ce22340047e05f9a171546669523a2e1166a8dc5cf59d626575
SHA512:	4d050b975209f5e33bd72ebe884a039bc3db0e34f6f60155112128dcf896518fe72f56a7745b08d928828bc7309a761560edbcd38f2c8634e79967c367e46c23
SSDEEP:	49152:vU/KqI1v4n+9INvofWSG3OdBhECpWYbxWxcC19i2mhFE:uIp6lvofWSq1CTb4vqh6
TLSH:	A8D53BE2740A72CFD08B1274A527DD5ABA6D87B9472149E3E82C74BBFD63CC111B9C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................1.....D.-...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE4ECD0EABAh
cmovb ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	ed1545e9b8db56f5f4891d152c4a5f0a	False	0.9995423370462047	data	7.980557470764062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wovnjubk	0x60000	0x2ad000	0x2ace00	c8ba2b6aea7f521361b5e8f520ebc417	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yaqwutur	0x30d000	0x1000	0x400	e50504822262e5826f426683cc94195e	False	0.693359375	data	5.597334070076034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30e000	0x3000	0x2200	e684e9547866298784fe0055efbd2915	False	0.0627297794117647	DOS executable (COM)	0.6592502449219162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T21:52:11.821142+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	57151	1.1.1.1	53	UDP
2024-10-25T21:52:11.888920+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	63649	1.1.1.1	53	UDP
2024-10-25T21:52:11.910630+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	55270	1.1.1.1	53	UDP
2024-10-25T21:52:11.993335+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	54597	1.1.1.1	53	UDP
2024-10-25T21:52:12.010457+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	52767	1.1.1.1	53	UDP
2024-10-25T21:52:12.025566+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	54509	1.1.1.1	53	UDP
2024-10-25T21:52:12.038171+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	64206	1.1.1.1	53	UDP
2024-10-25T21:52:12.055107+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	65025	1.1.1.1	53	UDP
2024-10-25T21:52:13.666681+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49719	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 21:52:12.083950996 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:12.083983898 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:12.084081888 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:12.139904976 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:12.139925957 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:12.990523100 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:12.990636110 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:12.992413998 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:12.992420912 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:12.992685080 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.036283970 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.084894896 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.127338886 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.666752100 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.666790009 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.666831970 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.666858912 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.666892052 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.667121887 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.667207956 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.667273045 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.667311907 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.681969881 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.682018042 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.682065964 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.682084084 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.682101011 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.682131052 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.695549965 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.695645094 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.695666075 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.695682049 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.695710897 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.695766926 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.715545893 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.715560913 CEST	443	49719	104.102.49.254	192.168.2.6
Oct 25, 2024 21:52:13.715601921 CEST	49719	443	192.168.2.6	104.102.49.254
Oct 25, 2024 21:52:13.715609074 CEST	443	49719	104.102.49.254	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 21:52:11.821141958 CEST	57151	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:11.833626986 CEST	53	57151	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:11.888920069 CEST	63649	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:11.901309013 CEST	53	63649	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:11.910629988 CEST	55270	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:11.921093941 CEST	53	55270	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:11.993335009 CEST	54597	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:12.003000975 CEST	53	54597	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:12.010457039 CEST	52767	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:12.024178982 CEST	53	52767	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:12.025566101 CEST	54509	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:12.034694910 CEST	53	54509	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:12.038171053 CEST	64206	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:12.052886963 CEST	53	64206	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:12.055107117 CEST	65025	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:12.065769911 CEST	53	65025	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:12.070177078 CEST	50139	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:12.077997923 CEST	53	50139	1.1.1.1	192.168.2.6
Oct 25, 2024 21:52:13.733191967 CEST	58757	53	192.168.2.6	1.1.1.1
Oct 25, 2024 21:52:13.744096041 CEST	53	58757	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 21:52:11.821141958 CEST	192.168.2.6	1.1.1.1	0x1a8b	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:11.888920069 CEST	192.168.2.6	1.1.1.1	0x58bc	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:11.910629988 CEST	192.168.2.6	1.1.1.1	0x4ba	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:11.993335009 CEST	192.168.2.6	1.1.1.1	0xf88b	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.010457039 CEST	192.168.2.6	1.1.1.1	0x2ff4	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.025566101 CEST	192.168.2.6	1.1.1.1	0x7db	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.038171053 CEST	192.168.2.6	1.1.1.1	0xeb8a	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.055107117 CEST	192.168.2.6	1.1.1.1	0x88a0	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.070177078 CEST	192.168.2.6	1.1.1.1	0x7459	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:13.733191967 CEST	192.168.2.6	1.1.1.1	0x9762	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 21:52:11.833626986 CEST	1.1.1.1	192.168.2.6	0x1a8b	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:11.901309013 CEST	1.1.1.1	192.168.2.6	0x58bc	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:11.921093941 CEST	1.1.1.1	192.168.2.6	0x4ba	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.003000975 CEST	1.1.1.1	192.168.2.6	0xf88b	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.024178982 CEST	1.1.1.1	192.168.2.6	0x2ff4	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.034694910 CEST	1.1.1.1	192.168.2.6	0x7db	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.052886963 CEST	1.1.1.1	192.168.2.6	0xeb8a	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.065769911 CEST	1.1.1.1	192.168.2.6	0x88a0	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:12.077997923 CEST	1.1.1.1	192.168.2.6	0x7459	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 25, 2024 21:52:13.744096041 CEST	1.1.1.1	192.168.2.6	0x9762	Name error (3)	sergei-esenin.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	104.102.49.254	443	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 19:52:13 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-25 19:52:13 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 25 Oct 2024 19:52:13 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=24617773c397a043c9b1ebce; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-25 19:52:13 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-25 19:52:13 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-25 19:52:13 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-25 19:52:13 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Target ID:	1
Start time:	15:52:08
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdc0000
File size:	2'974'720 bytes
MD5 hash:	C2FD4F13DBCBCDCA3D4C63A41BB3D9BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	73%
Total number of Nodes:	37
Total number of Limit Nodes:	3

Executed Functions

Function 00DCFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 00DD000D
t, xrefs: 00DCFCBE
VY^_, xrefs: 00DCFDFF
V, xrefs: 00DCFEDC

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: d9568cd749b85eb5a690d71076ea988500313ff5c51676fe63225c34d9213a2b
Instruction ID: c9fa163baf2103517bc4372b6b5ac8cdd385516f19d1ad318a8332e1b519af97
Opcode Fuzzy Hash: d9568cd749b85eb5a690d71076ea988500313ff5c51676fe63225c34d9213a2b
Instruction Fuzzy Hash: 6CD155745083819BD321DF189490B6FBFE2EB96B44F18881DF4C99B352C336C949DBA2

Function 00DCD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00DCD2F1

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 41b6bc7d15046f71f8030e2ceb2ee2659a8be2cb57eafa4bb9c9e2a15ad33d71
Instruction ID: 9d4d0b424671e596d59bc10ce9794beab8d9844ec431b348548264034dd6273f
Opcode Fuzzy Hash: 41b6bc7d15046f71f8030e2ceb2ee2659a8be2cb57eafa4bb9c9e2a15ad33d71
Instruction Fuzzy Hash: EE41037440D381ABD201AB68D985E2EFBF6EF52745F188C2CE5C497252C33AD8149B6B

Function 00E05BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00E0973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00E05BDE

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00E0695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00E069C5

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9b611e0e6a440759f01d84aa452e98367576e47a520fd4568d11024439900cac
Instruction ID: 69e5c9f03eff4daadff05b559c3a7a66f4d8be8620c2aee05ae1e50d7967a7ab
Opcode Fuzzy Hash: 9b611e0e6a440759f01d84aa452e98367576e47a520fd4568d11024439900cac
Instruction Fuzzy Hash: D531ADB1A083019FD718EF15C89072BB7F1FF94348F44A81CE5C6A72A1E3749994CB56

Function 00DD049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75479f95632a160477e7bdaac8152d061c5f52e2a5b21511abb2c554676d37e8
Instruction ID: 760399eb4addaf4a68f6641fbb6ef792d1ee3269059d57d9d831b020ed9484ed
Opcode Fuzzy Hash: 75479f95632a160477e7bdaac8152d061c5f52e2a5b21511abb2c554676d37e8
Instruction Fuzzy Hash: EE916A75200700CFD724CF26E894B16B7F6FF89310F158A6DE8969BAA1D731E859CB60

Function 00DD0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61438d7ab8c9835914fde4d458942ba50ed1262218e491cf24de3e652ee581b7
Instruction ID: 7917c5918d8508af9445223a3230244fc3069f7635afe06642e4166afe4a26d1
Opcode Fuzzy Hash: 61438d7ab8c9835914fde4d458942ba50ed1262218e491cf24de3e652ee581b7
Instruction Fuzzy Hash: 3A715C75200701DFD724CF22E894B16BBF6FF89314F148969E89697AA2C731E859CB60

Function 00E099D0 Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37ecfd4678150404dd3a0fbd604cd45e983c279e03d3076e310c58b826e8a4e
Instruction ID: cd2a7bbca043848a4d0c3bab39d1f6f1bb97f37c4d8dbe43ee897763c0736330
Opcode Fuzzy Hash: f37ecfd4678150404dd3a0fbd604cd45e983c279e03d3076e310c58b826e8a4e
Instruction Fuzzy Hash: F041AF35208300AFD7149E15D891B2BB7F6EB85724F14A82CE5C9A72D3D335E881CF66

Function 00E063B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ce3edbf5943bb2a2ded39205bb6f625ac465e0307bb02784e6e3bd9db3ca7d9e
Instruction ID: 0c5579ab723510f1531300d197334574621bf3ff4754dfa23d4f31ceabfc78cc
Opcode Fuzzy Hash: ce3edbf5943bb2a2ded39205bb6f625ac465e0307bb02784e6e3bd9db3ca7d9e
Instruction Fuzzy Hash: C431E370609301BED624DB04CD82F2BB7A2FBC0B14F64A908F1917A2D1D3B0A8A08B52

Function 00DD0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc32c811787c168b784adfe4735afd958e23a7ff42e0dcf38e7738205677bb7d
Instruction ID: 65529d002218870ba4d7fe7734db2f1fef03233ca364480bbce5b2ded813532e
Opcode Fuzzy Hash: fc32c811787c168b784adfe4735afd958e23a7ff42e0dcf38e7738205677bb7d
Instruction Fuzzy Hash: E6211AB490022A9FDB15CFA4CC90BBEBBB5FF4A304F244859E511BB392C735A915CB64

Function 00E03220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00E032A6

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5e995892bf066a9323e9bd412ed46fe3d4000eef060d05d2f447a6a776522096
Instruction ID: b63aab234b5fb8646ff0a017d30b33a756be9eb24ee60012579d3a26e948c717
Opcode Fuzzy Hash: 5e995892bf066a9323e9bd412ed46fe3d4000eef060d05d2f447a6a776522096
Instruction Fuzzy Hash: 14016D3450D2409FC701EF68E845A1ABBF8EF4A700F05891CE5C5AB361D335DD64CB96

Function 00E03202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00E03208

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 18e4f1d8ea9e53f59bccc05824b2703ac313b43426658a96e3051e6db47caf69
Instruction ID: bec22979a3ee2c3da5f1df683c4770db68ae205cec0e9c9753708dba6c988e9d
Opcode Fuzzy Hash: 18e4f1d8ea9e53f59bccc05824b2703ac313b43426658a96e3051e6db47caf69
Instruction Fuzzy Hash: 6DB012300400006FDA041F00EC0AF003510EB00605F800050A100140F1D1655878C554

Non-executed Functions

Function 00DF23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

mlc@, xrefs: 00DF275C
Cx, xrefs: 00DF453D
{l`~, xrefs: 00DF268C
%*+(, xrefs: 00DF40EF
`tii, xrefs: 00DF2693
:, xrefs: 00DF32DD
|}&C, xrefs: 00DF2F21
fedc, xrefs: 00DF2782
aenQ, xrefs: 00DF276A
#v, xrefs: 00DF344B, 00DF4861
f@~!, xrefs: 00DF25FF
3<, xrefs: 00DF32D6
ggxz, xrefs: 00DF2685

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: cf92ab93447d2564df151e8e8dc494683250e4f42dab9a070b12d3a3ceeb709c
Instruction ID: cd14adecffdda414b5a96e9fa6b0db7e6d4c5ec085c039e7ba296604d2517200
Opcode Fuzzy Hash: cf92ab93447d2564df151e8e8dc494683250e4f42dab9a070b12d3a3ceeb709c
Instruction Fuzzy Hash: 4733CA70104B818FD7258F39C590B72BBE1BF16304F59899DE5DA8BB92C735E806CBA1

Function 00DDDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

:WUE, xrefs: 00DDF6B7, 00DDF6C6
tsrq, xrefs: 00DDE6FC
89&', xrefs: 00DDE93B
QNOL, xrefs: 00DDE775
D, xrefs: 00DDE846
mjkh, xrefs: 00DDE7D8
()./, xrefs: 00DDE9CA
<=:;, xrefs: 00DDE930
`onm, xrefs: 00DDE733
89>?, xrefs: 00DDE9F6
LKJI, xrefs: 00DDE6E6
%*+(, xrefs: 00DDDE37, 00DDDE46
@ONM, xrefs: 00DDE6DB
<=2, xrefs: 00DDEA01
WP, xrefs: 00DDDCEF
lkji, xrefs: 00DDE73E
`Y^_, xrefs: 00DDE99E
T, xrefs: 00DDF157
dcba, xrefs: 00DDE728
AR, xrefs: 00DDDD10
DCBA, xrefs: 00DDE887, 00DDE896
|, xrefs: 00DDECB1
xgfe, xrefs: 00DDE71D
tuJK, xrefs: 00DDE967

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: c5aba3b3aa0f39baac1466de0e7774804092a91c065dc594bcbf5ca1385cd430
Instruction ID: 984366b2c193af3bd7ffbd5c69c14cd916d7517f0e7c9f724e799a7870fb5113
Opcode Fuzzy Hash: c5aba3b3aa0f39baac1466de0e7774804092a91c065dc594bcbf5ca1385cd430
Instruction Fuzzy Hash: 45F278B15083819BD770DF14C884BABBBE6BFD5304F18482EE4C99B391D7719985CBA2

Function 00DE9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

%e6g, xrefs: 00DEA152
?m,o, xrefs: 00DEA13C
sm, xrefs: 00DEA830
JG, xrefs: 00DEAA27
WH, xrefs: 00DEAA1C
CG, xrefs: 00DEAA32
S], xrefs: 00DEA636
WQ, xrefs: 00DEA62B
kW, xrefs: 00DEA380
N[, xrefs: 00DEA375
=], xrefs: 00DEA36A
_Y, xrefs: 00DEA641
/), xrefs: 00DEA66D
]{, xrefs: 00DEA1E7, 00DEA1F3
(a*c, xrefs: 00DEA147
Gt, xrefs: 00DE9FF8
hi, xrefs: 00DEAB9D

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 5ab116c2b5fb2a69c3e15f5c8e32083be6153cd40eb366747c60572bfa712c45
Instruction ID: d278f53602c2240df3b8d4a9996a4d237be7810064fe843439fe2bed1ab34c93
Opcode Fuzzy Hash: 5ab116c2b5fb2a69c3e15f5c8e32083be6153cd40eb366747c60572bfa712c45
Instruction Fuzzy Hash: AE52B7B444D385CAE270CF26D581B8EBAF1BB92740F609A1DE1ED9B255DB708045CFA3

Function 00DE9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

L3Y=, xrefs: 00DE9B03
B7U1, xrefs: 00DE9AFB
T#a-, xrefs: 00DE9AE3
,A&C, xrefs: 00DE982E
B?Q9, xrefs: 00DE9B0B
z=Q?, xrefs: 00DE9826
2A"_, xrefs: 00DE9980
!E4G, xrefs: 00DE9836
G'M!, xrefs: 00DE9ADB
G+X5, xrefs: 00DE9AF3
8;, xrefs: 00DE9B13
pq, xrefs: 00DE99E0
X/R), xrefs: 00DE9AEB
?M0K, xrefs: 00DE9968
;IJK, xrefs: 00DE983E
O+f), xrefs: 00DE9634, 00DE963D

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 7b1b5e66f2e03757a96e392240ac3bd0f5c556dd7be571fd1a3a0a9cd2e86293
Instruction ID: aa30b354481251edc94596b4b3538735dd964287f47daf8a8f335f2a0ad2451e
Opcode Fuzzy Hash: 7b1b5e66f2e03757a96e392240ac3bd0f5c556dd7be571fd1a3a0a9cd2e86293
Instruction Fuzzy Hash: 22F141B01093819BD310EF16D891A2BBBF4FB8AB44F144D1CF4D99B252D374D909CBA6

Function 00DEDD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DEE143
Y9N;, xrefs: 00DEE245
upH}, xrefs: 00DEDE8A, 00DEE798, 00DEDF4A
)IgK, xrefs: 00DEE261
{E, xrefs: 00DEE323
=]+_, xrefs: 00DEE276
,Q?S, xrefs: 00DEE26F
<Y.[, xrefs: 00DEE27D
hX]N, xrefs: 00DEDDC7
-M2O, xrefs: 00DEE25A
n\+H, xrefs: 00DEDDC0

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: 8ec525e89b579b509843f8ff165c3771650b2d8498eb35823ce405822a2bbd27
Instruction ID: d9d857ecb62096fe368fcc3d7f6e999355a79603b19ebfc1f53e89bc2806da32
Opcode Fuzzy Hash: 8ec525e89b579b509843f8ff165c3771650b2d8498eb35823ce405822a2bbd27
Instruction Fuzzy Hash: E9920471E00245CFDB08CF6AD8817AEBBB2FF49310F298169E555AB391D735AD05CBA0

Function 00DE098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

gce/, xrefs: 00DE1073
cah`, xrefs: 00DE107E
%*+(, xrefs: 00DE0A77, 00DE0A86
,#15, xrefs: 00DE0F94
{, xrefs: 00DE1502
&> &, xrefs: 00DE0F89
9.5^, xrefs: 00DE0F9F
qrqp, xrefs: 00DE1089

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: ba7c0ca7d5e7cb8f12f3c3775f9350b80306b5bc445684bbbef3de1cca7b6e2a
Instruction ID: a1b05b87588e810bd4b249d4e0d75701aa8d526f77272919f08e6f31bf272c03
Opcode Fuzzy Hash: ba7c0ca7d5e7cb8f12f3c3775f9350b80306b5bc445684bbbef3de1cca7b6e2a
Instruction Fuzzy Hash: BC62AAB56083818FD330DF15C891BABBBE1FF96314F08492DE49A8B681D3758985CB63

Function 00DC1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

gfff, xrefs: 00DC2226
@, xrefs: 00DC2C40
gfff, xrefs: 00DC2297
gfff, xrefs: 00DC22E1
0123456789ABCDEFXP, xrefs: 00DC157D, 00DC15EB
-, xrefs: 00DC21ED
0123456789abcdefxp, xrefs: 00DC1587, 00DC15F8

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: f65fc32b6d7c69fabdb1dd891676d1c31efe47200a591a8c54c8f1d91b18ac83
Instruction ID: 8f3235b85b3af30d9fbec2d19b21d16a1ec1852690e2f77ce89ed4ec6587eeda
Opcode Fuzzy Hash: f65fc32b6d7c69fabdb1dd891676d1c31efe47200a591a8c54c8f1d91b18ac83
Instruction Fuzzy Hash: 35D2F3756083528FD718CE28C490B6ABBE2AFD5314F1CCA2DE49987392D734DD45CBA2

Function 00F9428F Relevance: 10.5, Strings: 7, Instructions: 1709COMMON

Download Yara Rule

Strings

~kS1, xrefs: 00F951D1
0R'q, xrefs: 00F9542A
S62, xrefs: 00F95321
x:O|, xrefs: 00F94F8D
[Oi}, xrefs: 00F95333
sUw, xrefs: 00F94D7B
]Ke^, xrefs: 00F94794

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 0R'q$[Oi}$]Ke^$sUw$x:O|$~kS1$S62
API String ID: 0-4051137116
Opcode ID: 16784576e624c89fb0d1c3ee7963c22eaa5eb15a233553fe7d1637f8cacc9360
Instruction ID: 34f8d21bf2b646eb44eff636022d1ee424ad25dcf9ba9f9a7ee3af9035907eff
Opcode Fuzzy Hash: 16784576e624c89fb0d1c3ee7963c22eaa5eb15a233553fe7d1637f8cacc9360
Instruction Fuzzy Hash: 40B25AF3A0C2049FE304AE2DEC8577AB7E9EF94720F1A463DEAC5C3744E93558058696

Function 00F8D620 Relevance: 10.3, Strings: 7, Instructions: 1529COMMON

Download Yara Rule

Strings

&M]z, xrefs: 00F8DAA2
S;w[, xrefs: 00F8DF77
hzD, xrefs: 00F8D922
&%:h, xrefs: 00F8DD09
E9_, xrefs: 00F8E650
Vg/w, xrefs: 00F8DD46
5Gym, xrefs: 00F8D94B

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: &%:h$&M]z$5Gym$E9_$S;w[$Vg/w$hzD
API String ID: 0-3614352690
Opcode ID: 2197388f5f37b3c4412e0007c3fa32787867a4ab160f1df86b7b378d515dceb4
Instruction ID: f0b3259a4ade8d4825833ea959b37a3e23ebb8a2e3ff19bc2b284569f5d57e0b
Opcode Fuzzy Hash: 2197388f5f37b3c4412e0007c3fa32787867a4ab160f1df86b7b378d515dceb4
Instruction Fuzzy Hash: 11B2D1B390C2049FD304AF29EC8567AFBE5EF94720F16893DE6C483744EA3598458B97

Function 00F9C99C Relevance: 9.1, Strings: 6, Instructions: 1648COMMON

Download Yara Rule

Strings

Z], xrefs: 00F9D8F8
^B, xrefs: 00F9D2ED
cN~, xrefs: 00F9DD22
cN~, xrefs: 00F9DDAF
dZW, xrefs: 00F9CFD2
,}o, xrefs: 00F9D666

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: Z]$cN~$cN~$dZW$,}o$^B
API String ID: 0-3214560603
Opcode ID: d2bd68f1a2423c45350e5135d66d216ecc103b0e59d2cf1957a7cebe480181e0
Instruction ID: 77bb0de0cd3410dafcc324557c1a5b2c256183b5eb66041dba39c9e942d329c0
Opcode Fuzzy Hash: d2bd68f1a2423c45350e5135d66d216ecc103b0e59d2cf1957a7cebe480181e0
Instruction Fuzzy Hash: 14B219F3A08204AFE304AE2DDC8576AFBE9EF94720F16493DE6C4C7744E63598018796

Function 00F8A239 Relevance: 7.9, Strings: 5, Instructions: 1641COMMON

Download Yara Rule

Strings

jFO, xrefs: 00F8AD60
xE?=, xrefs: 00F8B4DF
Wy>z, xrefs: 00F8ACA8
:@1:, xrefs: 00F8AC95
`N{;, xrefs: 00F8AB89

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: :@1:$Wy>z$`N{;$jFO$xE?=
API String ID: 0-1430552244
Opcode ID: a8f88c33c98b5e9687ad286f1f02dd157016ee1c3b63985b9d8181900dc877be
Instruction ID: f6447d9e3447df00629a9fd4765e63117e501193c46215b9d95d445cd5f516a6
Opcode Fuzzy Hash: a8f88c33c98b5e9687ad286f1f02dd157016ee1c3b63985b9d8181900dc877be
Instruction Fuzzy Hash: 91B205F360C6049FE304AE2DEC8567AFBE5EF94320F16893DEAC4C7744EA3558058696

Function 00FA0048 Relevance: 7.9, Strings: 5, Instructions: 1630COMMON

Download Yara Rule

Strings

B"yz, xrefs: 00FA0D60
9S, xrefs: 00FA01F3
v=w, xrefs: 00FA098A
y=, xrefs: 00FA0523
]B=_, xrefs: 00FA0ECF

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: y=$B"yz$]B=_$v=w$9S
API String ID: 0-1174411796
Opcode ID: 5032098c8d7291f61134b41294520735c0a758f17ce92b7c678f87fb1eed7f06
Instruction ID: 02638b8684bf546c488f8c06956620cb69abe3dd37e548b4e6521418c14e5c2d
Opcode Fuzzy Hash: 5032098c8d7291f61134b41294520735c0a758f17ce92b7c678f87fb1eed7f06
Instruction Fuzzy Hash: 3EB2F7F360C2049FE704AE2DEC8567ABBE9EF94320F1A493DE6C5C3744E63598058697

Function 00F993D9 Relevance: 7.9, Strings: 5, Instructions: 1622COMMON

Download Yara Rule

Strings

ZR~, xrefs: 00F9A146
Eqc, xrefs: 00F99FFA
!?=7, xrefs: 00F9A024
h5K, xrefs: 00F99B68
-, xrefs: 00F9A0C6

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: !?=7$Eqc$ZR~$h5K$-
API String ID: 0-815493978
Opcode ID: ecdeedec91631f22315d39a8abecfd762e2e5a5712b118face4d986db47684ff
Instruction ID: 058e632de978c37210ff1ef2ab86304a2a11386f59ecd0ea3d750f6735afbe68
Opcode Fuzzy Hash: ecdeedec91631f22315d39a8abecfd762e2e5a5712b118face4d986db47684ff
Instruction Fuzzy Hash: 8BB227F390C2109FE3046E2DEC8567ABBE5EF94720F1A493DEAC4D7744E63598018796

Function 00F8F590 Relevance: 7.5, Strings: 5, Instructions: 1273COMMON

Download Yara Rule

Strings

i@<;, xrefs: 00F8F813
\>$B, xrefs: 00F901E9
Cj[, xrefs: 00F9029D
qw}, xrefs: 00F8FAA9
pko, xrefs: 00F8FF8C

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: Cj[$\>$B$i@<;$pko$qw}
API String ID: 0-1819597183
Opcode ID: 9d1a0afca75b6fc226cb3f702feb7ca66ca808facfffe7d9c7a1cabb8c864ff6
Instruction ID: f7582e7811556a468294bffe14f93fa1d18d6a366263181d40e26b77c22760de
Opcode Fuzzy Hash: 9d1a0afca75b6fc226cb3f702feb7ca66ca808facfffe7d9c7a1cabb8c864ff6
Instruction Fuzzy Hash: AA8217F36086049FE304AE2DEC8567AFBE5EF94720F1A493DE6C5C3744E63598048693

Function 00DC12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

@, xrefs: 00DC3531
0, xrefs: 00DC1DC1
i, xrefs: 00DC28EA
0, xrefs: 00DC1E88
0, xrefs: 00DC243E

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 5d213a0c8f672246fbffc50cb55552849bdc4e8ff201cd146fcde0314e96bcb3
Instruction ID: 5fc1eff0b69835ca3db0ddb4af880ac771ac35d9a3e7b80b22b8eca258de9e38
Opcode Fuzzy Hash: 5d213a0c8f672246fbffc50cb55552849bdc4e8ff201cd146fcde0314e96bcb3
Instruction Fuzzy Hash: 2862D47160C3928FC319CF28C490B6ABBE1AFD5304F188A2DE8D987391D774D949CB62

Function 00DC164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00DC1F3C
0123456789ABCDEFXP, xrefs: 00DC164F
gfff, xrefs: 00DC1F57
+, xrefs: 00DC1573
0123456789abcdefxp, xrefs: 00DC1659

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: c5ffff0b0fb48f257f6e3f3e416897f265b72fd467744e288379938e738f010c
Instruction ID: 7a63b1d2368f3c8cba5dd0f1523b005219ba1bd58d95e5bb5e7682cc9f43bd3e
Opcode Fuzzy Hash: c5ffff0b0fb48f257f6e3f3e416897f265b72fd467744e288379938e738f010c
Instruction Fuzzy Hash: 0AF1C23560C3928FC719CE28C48476AFBE2AFD9304F188A6DE4D987356D734D945CBA2

Function 00DC13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00DC1F3C
0123456789ABCDEFXP, xrefs: 00DC13A3
gfff, xrefs: 00DC1F57
-, xrefs: 00DC1F23
0123456789abcdefxp, xrefs: 00DC13AD

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 18408594f19c566f12f7c25e75e1273800fa83cd0b237a1f61dae8bbe89539dd
Instruction ID: 46eeb69419bcd5572e630676893a5542be573f871c0e662e55da67fc2a9d33cb
Opcode Fuzzy Hash: 18408594f19c566f12f7c25e75e1273800fa83cd0b237a1f61dae8bbe89539dd
Instruction Fuzzy Hash: 27D1AE3560C7928FC719CE29C48076AFBE2AFD9304F08CA6DE4D987356D634D949CB62

Function 00DEFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

NA_I, xrefs: 00DF036D
:, xrefs: 00DF0087
m1s3, xrefs: 00DEFEC3, 00DEFECB
uvw, xrefs: 00DEFE95

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 30f4b9168544a24ad3cafc660a24237d87b6bff69a8c339a567bbac1aac4cc8f
Instruction ID: 211b6e644e70e8c19e38e6caac4f05453648590722c93443e7272478549eecce
Opcode Fuzzy Hash: 30f4b9168544a24ad3cafc660a24237d87b6bff69a8c339a567bbac1aac4cc8f
Instruction Fuzzy Hash: 2032AAB1508385DFD311DF29D880B2ABBE5EF8A300F19895CF6D59B292D335D909CB62

Function 00DD3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DD3EC4
;z, xrefs: 00DD3C87
p, xrefs: 00DD3C80
ss, xrefs: 00DD3C79

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 2487d4083a5497a3112fab3f1d993b2570768db63c7e9e0b425f250e36b2acc5
Instruction ID: 19a801038eaf3f8bcad4dc3460dca862c78d23fe1d733bfc10bb9083c0841f97
Opcode Fuzzy Hash: 2487d4083a5497a3112fab3f1d993b2570768db63c7e9e0b425f250e36b2acc5
Instruction Fuzzy Hash: E9025AB4810B00DFD7609F29D986756BFF5FB02300F50895DE89A9B796E370A418CFA2

Function 00DE2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 00DE232F
sj, xrefs: 00DE2327
a|, xrefs: 00DE2317
lc, xrefs: 00DE2507

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 03cce7fca6bbed814fc7b5ad211a3174632016c496e32d55a65214fabf6e7186
Instruction ID: 601dbf104696909b249cd1384386653f1db64cbc8197857240785951db85baf3
Opcode Fuzzy Hash: 03cce7fca6bbed814fc7b5ad211a3174632016c496e32d55a65214fabf6e7186
Instruction Fuzzy Hash: E1A1AE704083818BC720EF19C891A3BB7F4FFA5354F588A0CE8D99B291E375D941CBA6

Function 00F90D7B Relevance: 5.4, Strings: 3, Instructions: 1631COMMON

Download Yara Rule

Strings

N$~, xrefs: 00F91463
#iru, xrefs: 00F91EF0
<j?, xrefs: 00F90FF9

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: #iru$<j?$N$~
API String ID: 0-2518996731
Opcode ID: 1037106747bdc99187febe2cffba0293d46e0aa33df76253c9194666ec5502b1
Instruction ID: 5e2b73d366aaec813557513fd0aa9bcfe8daf21bdaa83f95d4bed8548571b318
Opcode Fuzzy Hash: 1037106747bdc99187febe2cffba0293d46e0aa33df76253c9194666ec5502b1
Instruction Fuzzy Hash: A8B22AF390C2049FE3146E2DEC8567AFBE9EF94720F1A463DEAC4D3744EA3558058692

Function 00F9E5A0 Relevance: 5.3, Strings: 3, Instructions: 1572COMMON

Download Yara Rule

Strings

P,s_, xrefs: 00F9F39F
{C}], xrefs: 00F9F290
Z+n, xrefs: 00F9E8A8

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: P,s_$Z+n${C}]
API String ID: 0-2337308888
Opcode ID: 15d639c95f83d8d4bdd432fde3e6c24421d09e393941d23a025962b6b3323943
Instruction ID: 67345ae96daf600ea05b92fac409ddc8c075085c80008edbadc03a2ba76e8997
Opcode Fuzzy Hash: 15d639c95f83d8d4bdd432fde3e6c24421d09e393941d23a025962b6b3323943
Instruction Fuzzy Hash: 79B208F3608204AFE304AE29EC8567ABBE5EFD4320F16893DE6C4C7744E63598118797

Function 00F95E7A Relevance: 5.3, Strings: 3, Instructions: 1564COMMON

Download Yara Rule

Strings

\<U, xrefs: 00F96431
fHw^, xrefs: 00F9656C
$j_, xrefs: 00F97146

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: \<U$fHw^$$j_
API String ID: 0-4120558422
Opcode ID: 9cc79644c995ef1c81ab155e628e81ebcbf518278fb1e6a0459d4efa9c5022b8
Instruction ID: bcc514500d6e5cf7e58b0d5511f4eff2056d76631dfc95081474760d8328ce50
Opcode Fuzzy Hash: 9cc79644c995ef1c81ab155e628e81ebcbf518278fb1e6a0459d4efa9c5022b8
Instruction Fuzzy Hash: E4B2E5F3A08210AFE3046E2DEC8577ABBE5EF94760F16453DEAC4C3744EA3598058697

Function 00DED7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

KV, xrefs: 00DED97D
#', xrefs: 00DED9EA
CV, xrefs: 00DED98B
T>, xrefs: 00DED984

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c33df8be8c1bb0a51d88339df1186eac3d2ffa09bb24b657d9abf9eb31c5007e
Instruction ID: 539e9cef980eccff96d0135a0e5ea28d82c344fd33f37a527f50505bebe1b563
Opcode Fuzzy Hash: c33df8be8c1bb0a51d88339df1186eac3d2ffa09bb24b657d9abf9eb31c5007e
Instruction Fuzzy Hash: 948145B48017499FDB20EF96D68516EBFB1FF16300F60560CE486ABA55C330AA55CFE2

Function 00DEAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

4c2a, xrefs: 00DEACA9
(g6e, xrefs: 00DEACA1
,{*y, xrefs: 00DEAD07, 00DEAD13
lk, xrefs: 00DEACBC

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: b278369dc483ac7e3fc3fd50f5da32416f6fa7c3493c295e827588e3ffd17b66
Instruction ID: 62285f14a249f3364ba110fbf593222a943300b50583efcc0768ef214ad08440
Opcode Fuzzy Hash: b278369dc483ac7e3fc3fd50f5da32416f6fa7c3493c295e827588e3ffd17b66
Instruction Fuzzy Hash: 854178B4808382CED7209F25D900BABB7F0FF86305F54995DE6C8A7250E775D948CB96

Function 00DEC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DEC8C3, 00DEC8CB
~/i!, xrefs: 00DEC537
%*+(, xrefs: 00DEC9E4, 00DEC9ED

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 7d981dd4be51d049a9c6d511557850f407d1cfa448a939b41973edeefbf25c87
Instruction ID: 6353ad887b1a4c4c91dc7ccc4473118e35ad180bbd20d6822c73ec517168ed4c
Opcode Fuzzy Hash: 7d981dd4be51d049a9c6d511557850f407d1cfa448a939b41973edeefbf25c87
Instruction Fuzzy Hash: 53E198B5518384DFE320AF26D881B5BBBF5FB85340F48882CE69997252D732D815CF62

Function 00DC8590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

IEND, xrefs: 00DC89F0
), xrefs: 00DC8616
), xrefs: 00DC860C

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4db673d54ff572fa2988a15ebaaf9e439f860bb2b9b42163aca54341b8174975
Instruction ID: d05b53ee8a0a960853b74d6820ef9e2fa803e834aa615fa781582b38aa1dc917
Opcode Fuzzy Hash: 4db673d54ff572fa2988a15ebaaf9e439f860bb2b9b42163aca54341b8174975
Instruction Fuzzy Hash: 1FE1BEB1A087029FE310CF29C885B2ABBE0FF94314F14492DE59997381DB75E915DBE2

Function 00F97B15 Relevance: 3.9, Strings: 2, Instructions: 1449COMMON

Download Yara Rule

Strings

d</-, xrefs: 00F98666
*4~, xrefs: 00F98926

Memory Dump Source

Source File: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: *4~$d</-
API String ID: 0-247995745
Opcode ID: 688c1c1b351d48688d55c7f9eda270f3f730b7d0b7d8ad869bce644741278198
Instruction ID: 2ccd3fb1c2793f2e99bc02afde85eea592c4db2a106f8074526a475b62d80878
Opcode Fuzzy Hash: 688c1c1b351d48688d55c7f9eda270f3f730b7d0b7d8ad869bce644741278198
Instruction Fuzzy Hash: DDA229F36082049FE304AE2DED8567AFBE9EFD4720F1A863DE6C4C3744E63558058696

Function 00E04040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 00E0420C
%*+(, xrefs: 00E040A4, 00E040AD

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: a62200b5e1448ae742496237ab4f3f52026e750e376ede8ead269a544318d55d
Instruction ID: ba373faf30a2b906db99d4d75b275c0e8e739866550a754a10f41faab8ab88a5
Opcode Fuzzy Hash: a62200b5e1448ae742496237ab4f3f52026e750e376ede8ead269a544318d55d
Instruction Fuzzy Hash: 00129DB16083419FC715CF14C980B2BBBE2FBC9318F189A2DF694A72D1D735D9858B92

Function 00DFF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 00DFF7F5
hi, xrefs: 00DFF6E6

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: b52d959b2766a5430083ca3ac7fb552da9e0c98dd0028f0eb14d6181505a3f1b
Instruction ID: e038db5bb0c8b23b3c12c66bb32ad8137c8c3ea0914054270d69028b3d528797
Opcode Fuzzy Hash: b52d959b2766a5430083ca3ac7fb552da9e0c98dd0028f0eb14d6181505a3f1b
Instruction Fuzzy Hash: 29F19571618301EFE704CF25D891B6ABBE6FF89344F15992CF2959B2A1C734D845CB22

Function 00DC35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 00DC3607
NaN, xrefs: 00DC360E

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 0fb0e578fb17dad982ad3410f02a062d5cbae18064a002300cab08b5fd435f17
Instruction ID: fe3bbd31bf88d15c88bc688130258903cb9c1868b42639fd360f189149f7071f
Opcode Fuzzy Hash: 0fb0e578fb17dad982ad3410f02a062d5cbae18064a002300cab08b5fd435f17
Instruction Fuzzy Hash: A7D1D371A183129BC704CF29C880B1ABBE1EFC8750F15CA2DF9D9973A0E675DD458B92

Function 00DDFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00DE0197
Ye[g, xrefs: 00DE00F6

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 6495a13e6ee85fae8869e4606fde7ec8a458f962b61d132e6bee86fc2608087c
Instruction ID: 111ced5d6e6955ae752ade6daa4ac35c673a912826fcb711b1e4e63d0006cc4d
Opcode Fuzzy Hash: 6495a13e6ee85fae8869e4606fde7ec8a458f962b61d132e6bee86fc2608087c
Instruction Fuzzy Hash: 65519C716083818BD731DF59C481BABBBE0FF96310F19491DE4998B651E3B49980CB67

Function 00DC5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00DC54C8

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 595186172e1fe160c0c5349397f7e87c6cf1101f7cc899668346576e987b1c33
Instruction ID: ebfb9a42b9cbd89ad6ceb98534bb80767d2e18442ccda7e1e7584b95a0acc4dc
Opcode Fuzzy Hash: 595186172e1fe160c0c5349397f7e87c6cf1101f7cc899668346576e987b1c33
Instruction Fuzzy Hash: BD22C5B6608B43CBE7158E18E540B26BBA2AFE0304F1D856DD8994B389E771FCC5C761

Function 00DF12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00DF15D1

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 69506f9c26846f48324fa963958e35a437e06d1d49583ef7e36c9566206a0e50
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 79F15679A083499BC724CE24C480A3BBBE5AFC5340F0EC56CE98987382D631DD05C7B2

Function 00DEAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DEB2D3, 00DEB2DB

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ab68dc09813367dfefc5c3cd1d515dfced14bc1b039595f72210a5ce023baceb
Instruction ID: 81797eea0c067db61791b34f96ec0a237f5059a57cc11e26c87f3fd90d870419
Opcode Fuzzy Hash: ab68dc09813367dfefc5c3cd1d515dfced14bc1b039595f72210a5ce023baceb
Instruction Fuzzy Hash: B6E1BA71508346CBC314EF2AC49056BB3E2FF997A1F58891DE5C597260E330EA59CBA2

Function 00DD6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DD6EF3

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 10a857ea7f6d8f9d8ab42e570de9bbc3a98e4d8bb968ecdcfff883c5a2d026ca
Instruction ID: ce2769ff8d3afa819bcfb048eda26fe9ee3366e543810ac33403edd154d87340
Opcode Fuzzy Hash: 10a857ea7f6d8f9d8ab42e570de9bbc3a98e4d8bb968ecdcfff883c5a2d026ca
Instruction Fuzzy Hash: A5F1A075610A01CFD734DF29D881A26B3F2FF48314B148A2EE59787B91EB31E855CBA0

Function 00DE7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DE8263, 00DE826B

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a8823c489e412843743fcd01a5a214da674cd766f01c2e63429dbf2dfd633ddc
Instruction ID: 58caf786be740337906e6ce288438e425b1867728a593374e57108f12dc5e42c
Opcode Fuzzy Hash: a8823c489e412843743fcd01a5a214da674cd766f01c2e63429dbf2dfd633ddc
Instruction Fuzzy Hash: 2EC1BF71508380ABD710AF16C882A2BB7F5EF95754F08881CF9C99B292E735DD05DBB2

Function 00DE8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DE9233, 00DE923B

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 06fa714e42d2478ee53a68b0d4c23f572345289cf9ec18f845341a4bed9446ab
Instruction ID: a0ce3a42ce77008adc1a75b6209786a66890b8c535ac7e331935fafe6e091551
Opcode Fuzzy Hash: 06fa714e42d2478ee53a68b0d4c23f572345289cf9ec18f845341a4bed9446ab
Instruction Fuzzy Hash: DCD10070608342DFD704DF6AEC91A6AB7E5FF88300F49886CF88697291D771E984CB61

Function 00E07FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00E08167

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 92dfb8acf13d0f32fce66c6118770533a5a1fba153f3c16fc5bf52c7fc821f3c
Instruction ID: 5986f07563b974470b63894189d7e65561018a6b683f2b6c55035aad99b4af56
Opcode Fuzzy Hash: 92dfb8acf13d0f32fce66c6118770533a5a1fba153f3c16fc5bf52c7fc821f3c
Instruction Fuzzy Hash: E3D1C1729082658FC725CE18A89075EB6E1EBC5718F159A2CE8F5BB3D0CB719C86C7C1

Function 00E06CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"p, xrefs: 00E07015

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: "p
API String ID: 0-1647296830
Opcode ID: d3d2a55a5da04a962ec4e59167a0b0cb268b447040831ae45445421ec5cdaf61
Instruction ID: a095987acb4ef839d353ebc25828b7a877564873518c3e37d98384d3d3eaf48b
Opcode Fuzzy Hash: d3d2a55a5da04a962ec4e59167a0b0cb268b447040831ae45445421ec5cdaf61
Instruction Fuzzy Hash: D4D1F236618351CFC714CF39D8C056AFBE2AB89314F098A6DE495E73A1D330DA49CBA1

Function 00DECCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DECDC3, 00DECDCB

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: c5467e3cc77b61a23c392e96d4ca5f1e1c097bccfb83798c32dae7b4e20651ed
Instruction ID: c4e5d9028d3be69321f0ff52f38de26483a17b9a4958509c46c4c4568cdd9ef9
Opcode Fuzzy Hash: c5467e3cc77b61a23c392e96d4ca5f1e1c097bccfb83798c32dae7b4e20651ed
Instruction Fuzzy Hash: D8B111716193818FD714EF1AD881B2BBBE2EF85340F18582CE5C59B291E731D856CBB2

Function 00DCA850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00DCA9C3

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: 1c293d323b7b3f27c158ef5221afc5048dbacea6f03bdb96dd801067c3d0c282
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: BAB12A711083859FD325CF58C880B1BBBE1AFA9708F484A2DF5D997342D671EA18CB67

Function 00DFFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DFFCA4, 00DFFCAD

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 98f9d3355f9a903f9639a2e2cb3a87064e8678feb4184fd5e3bf57f2d479fad7
Instruction ID: 7a0f95f0241eabae64990019b931c30f20f7b52a62a0d6242bd77e939ccdc94a
Opcode Fuzzy Hash: 98f9d3355f9a903f9639a2e2cb3a87064e8678feb4184fd5e3bf57f2d479fad7
Instruction Fuzzy Hash: 6F81B871608204EFD710DF69DC85A2AB7E5FF99701F09882CF6C4A7292D731E859CB62

Function 00DDD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DDD663, 00DDD66B

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 245e64a6133249161a007dbc9444daddead4fb86a9ca0bba682cc8a8d3192315
Instruction ID: 756fbe9aa25eec1fc782e2007e5b78ddaf62ceb02ce44cfda8340643a464a30a
Opcode Fuzzy Hash: 245e64a6133249161a007dbc9444daddead4fb86a9ca0bba682cc8a8d3192315
Instruction Fuzzy Hash: 4B611372909204DFCB10EF18DC42A6A73B1FF95344F08492DF98997392E375E905C7A2

Function 00E04A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E04C33, 00E04C3B

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1a5aeae17874c31bf497a693e98edc2c87cbe11f8311320d4fb234cf19dd998c
Instruction ID: 042b55333e875fc0d8042c7fb6bc817cb1a07b720acec5ade2ea6c55c2fe31a1
Opcode Fuzzy Hash: 1a5aeae17874c31bf497a693e98edc2c87cbe11f8311320d4fb234cf19dd998c
Instruction Fuzzy Hash: ED61DDF16083019BE711DF65C980B2AF7E6EBC4318F18991CEA85A72D1D671EC90CB52

Function 00EE177A Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

9P, xrefs: 00EE194F

Memory Dump Source

Source File: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 9P
API String ID: 0-1555359944
Opcode ID: 4508d00f274c1a97a6f1d9d86ea2424ae12f8e5c71f7cbc221ff63750ccd302b
Instruction ID: 2c0167c942f4fe87b79c78fe760b1cb526b23d9bf0d64e41d878e8646246b980
Opcode Fuzzy Hash: 4508d00f274c1a97a6f1d9d86ea2424ae12f8e5c71f7cbc221ff63750ccd302b
Instruction Fuzzy Hash: 9761A3F3A082009FE3556E29DC8576AB7E2EF94310F1A493DD6C9C3780E67998418B87

Function 00EB42DE Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

{ioM, xrefs: 00EB4313

Memory Dump Source

Source File: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: {ioM
API String ID: 0-812925547
Opcode ID: 560cfee3cb6f3e10f28d8f8803f54e4a1c51eb18201f541f75703e6acbe1ba70
Instruction ID: 3619253f0b539b8c9d2d0f1574278df89134a062f23a2fc51a799ad8a7b6a4aa
Opcode Fuzzy Hash: 560cfee3cb6f3e10f28d8f8803f54e4a1c51eb18201f541f75703e6acbe1ba70
Instruction Fuzzy Hash: E0519AF3A086046FE3006A2DEC4577ABBDADBD4320F1B463DE6D4C3784E93994058686

Function 00DCE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00DCE333

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 3843fbbfdf82afbd02aecac20dc37033a90a461de1b5b108b69013b2fd836fb6
Instruction ID: 46d4c855eda33b0a93805b050e65f6120921ea2b4c1c89bce585839a474df7a3
Opcode Fuzzy Hash: 3843fbbfdf82afbd02aecac20dc37033a90a461de1b5b108b69013b2fd836fb6
Instruction Fuzzy Hash: 4A512773A196D24BD338897D4C557A9AB870FA2334B3DC76EE9F18B3E1D556880483A0

Function 00E03920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E039E3, 00E039EB

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 7e8901b385c035c3cbe02cc88bba274c7dae01dc08aa2b9b89cd1a6154160cf4
Instruction ID: afb466d2d5f9b30fe8e27cd63e7cc4f0cecf944d0330e91f06e784a56895f020
Opcode Fuzzy Hash: 7e8901b385c035c3cbe02cc88bba274c7dae01dc08aa2b9b89cd1a6154160cf4
Instruction Fuzzy Hash: 1B519E35609200DFCB24DF65D880A2ABBFAEFC5748F18991DE4C6A7291D371DD90CB62

Function 00EC10DB Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

QE}~, xrefs: 00EC11A0

Memory Dump Source

Source File: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: QE}~
API String ID: 0-159949680
Opcode ID: 105663a0ce520a5e11a0a651d970f584a4890daa5d3d36c7016b4902516436c9
Instruction ID: 8f6eea0fbfe7eba444e2c868894bb1fd37168fac7020d769352533421ec493a9
Opcode Fuzzy Hash: 105663a0ce520a5e11a0a651d970f584a4890daa5d3d36c7016b4902516436c9
Instruction Fuzzy Hash: 364168F3B083045BF308692DEC89767B6C6DBC4320F2B423DDA45C7B84ED7A58014245

Function 00F0C991 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

1THx, xrefs: 00F0CADE

Memory Dump Source

Source File: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 1THx
API String ID: 0-1679358647
Opcode ID: 9198392358725e78424e84b21c0bb4fb0c54fd032ddc9c4da00e6ebb99d0f80a
Instruction ID: 0a0c34531910cc6fb3938476bbe4f8fd71cf4d6e56507da98d740724d1ae20a1
Opcode Fuzzy Hash: 9198392358725e78424e84b21c0bb4fb0c54fd032ddc9c4da00e6ebb99d0f80a
Instruction Fuzzy Hash: E141E1F3A186149FE3046E29DC857BABBD5EB98320F1B093DDBC4D3780E67548458B86

Function 00DD1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00DD1C3E

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 51bc8be1cae60a57bf7c6667db276b1feaf42c46af586b7bc45782baaf90c086
Instruction ID: a319fa659e552265cc5a0fd99f4946b0ace73987211e011e560954dc0ca7220a
Opcode Fuzzy Hash: 51bc8be1cae60a57bf7c6667db276b1feaf42c46af586b7bc45782baaf90c086
Instruction Fuzzy Hash: AF4161B8018380ABC7149F69C894A2FBBF0FF86314F08891DF5C5AB290D736C9158B66

Function 00DFFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E00033, 00E0003B

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b1bd6d739732e44bb095e902fe25e30fffeee832d7cf991f50504ab06414cb20
Instruction ID: facaf959d926352283913726c74a9e00cd1230a1b57a87e562ff8df1ac30a3dc
Opcode Fuzzy Hash: b1bd6d739732e44bb095e902fe25e30fffeee832d7cf991f50504ab06414cb20
Instruction Fuzzy Hash: 4D31D6B1A04305ABD610EE54DC81F2BB7E9EF85748F545C28F985E7292E232DC94C763

Function 00DEE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00DEE6A2

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 9914bed8027e21d107699a912f21b19ccc1e3b32f2fcbe2d14c2580994163ec4
Instruction ID: 8509c953755e25e8ecbb07fd97c00ac3515ee3527fd9c6c49474386d9c8aa12b
Opcode Fuzzy Hash: 9914bed8027e21d107699a912f21b19ccc1e3b32f2fcbe2d14c2580994163ec4
Instruction Fuzzy Hash: 4431E6B5900245CFCB20EF96E8809AFBBB5FB46305F58486CE54AA7301D331A905CBB2

Function 00DD6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00DD703B

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 84b027def469715d3805cb6965ba6cc9d686abe8c5b218882575ac5eb81714b7
Instruction ID: 44cea0297ea592ffa42f7137ede2618cc5c306c5ca1893dec4b1535fa6ed5f7a
Opcode Fuzzy Hash: 84b027def469715d3805cb6965ba6cc9d686abe8c5b218882575ac5eb81714b7
Instruction Fuzzy Hash: FD414572205B04DFD7348F66C995B26B7F2FB49701F18885AE5869BBA1E371F8008B60

Function 00DEE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00DEE6A2

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 4480e12bd16211f5586fc74cc1dcaa53c4335d8a711786aebf72871499b2c659
Instruction ID: ef701d5f2d65ea2a1cceb8cecc0ceb32d45f99af957dd1dbb72ba2abf3f87186
Opcode Fuzzy Hash: 4480e12bd16211f5586fc74cc1dcaa53c4335d8a711786aebf72871499b2c659
Instruction Fuzzy Hash: 7621E2B1900245CFC720EF96D880AAFBBB5FB4A700F58485CE586AB301C331AD05CBB2

Function 00E09CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00E09D30

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: e4cdbc5f2e530de9c323c367389d5ba353c9634a1f5f91efd24a0024fa4e275a
Instruction ID: 12feb3a472003d1189e97b529351bdc43598887637c3e78c20cbe12e404b00c5
Opcode Fuzzy Hash: e4cdbc5f2e530de9c323c367389d5ba353c9634a1f5f91efd24a0024fa4e275a
Instruction Fuzzy Hash: 26315A705093009BD314EF15D880A2BFBF9EF9A318F14992DE5C4A7292D375D944CB66

Function 00DD4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b529072f0fc0884278474a8267c94c62845236c88a7b62c06384291dfbc9c7
Instruction ID: a90a5407844d1eceeb4e2caa8f2eda0f11f7a119864b4de3c6f41bdb0e1ef228
Opcode Fuzzy Hash: 92b529072f0fc0884278474a8267c94c62845236c88a7b62c06384291dfbc9c7
Instruction Fuzzy Hash: A8625774510B418FD735CF28E890B26B7F6EF46700F58892ED49A87B56E731E848CBA0

Function 00DCBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 34a1d48e7ba5661304797eb0bce68323473d18fca2c3b95c468c07ab0d9a613e
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 01521A316287128BC7259F18D4407BBF3E1FFC4319F299A2DDACA93290D734A851CB96

Function 00E08652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8790467877081e3dd9e1188ecea9c0fff3d947dfefe10e8de253e199523898c
Instruction ID: 5dac64c193966abdd0f5e73966160502b0efdc44da68e81106ff113f005cfc96
Opcode Fuzzy Hash: f8790467877081e3dd9e1188ecea9c0fff3d947dfefe10e8de253e199523898c
Instruction Fuzzy Hash: 0A22FCB5609341DFC704DF69E88066AB7F1FF89315F09886DE489A73A2C735D894CB42

Function 00E086F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598f0e6252f680bffc4755f7fc7771ae956ba175f28f114cd208255f2dc1cb0d
Instruction ID: aec16cd87353b413acf55a90dcc546458cf2e2d506f8283a3a0c5a2ec9724e5b
Opcode Fuzzy Hash: 598f0e6252f680bffc4755f7fc7771ae956ba175f28f114cd208255f2dc1cb0d
Instruction Fuzzy Hash: 8322CAB5609340DFC704DF69E89065ABBF1FB8A305F09896DE4C9A73A2C735D894CB42

Function 00DCB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11168e8b8cf80ce9ef9bdf119e8a62beb32c7117f9f19a9ffad7be406d03574d
Instruction ID: 6cc438dc7b064d14c76062850c1517dc02155c66d6c685e1c5d1e35b77c25867
Opcode Fuzzy Hash: 11168e8b8cf80ce9ef9bdf119e8a62beb32c7117f9f19a9ffad7be406d03574d
Instruction Fuzzy Hash: 4852C8709087858FEB35CB24C045BA7BBE1EF95324F184C2EC5E607A82C779E885CB65

Function 00DC71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23267604f4cd3ff9823ae2fb2474bc0f999ee19afc4a810b8c0ec3bcb81b4532
Instruction ID: e35929dceee19daa01b62819474421042ee557283e17c76ed6f382bbc315a2a0
Opcode Fuzzy Hash: 23267604f4cd3ff9823ae2fb2474bc0f999ee19afc4a810b8c0ec3bcb81b4532
Instruction Fuzzy Hash: 52528E3150C3468FCB15CF29C090BAABBE2BF88314F198A6DE89997351D774D989CF91

Function 00DC8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa32e300c221ec505ad461099766a27fda18e1de9ca3d0e2d2c3253e5d857cc
Instruction ID: b406640bfd58f255577289d4f4b7a9828d5e3dddfd25af333349f90dac213e40
Opcode Fuzzy Hash: 3fa32e300c221ec505ad461099766a27fda18e1de9ca3d0e2d2c3253e5d857cc
Instruction Fuzzy Hash: 64426775608302DFD708CF29D864B5ABBE1BF88315F09886CE4958B391D73AD989CF52

Function 00DC7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3aef99367f62e0916239a7ec480fcbf2c425f3c8f74b6cff9783156f1ac1e1
Instruction ID: 682afde593291bff4fa87a538811d480bcae48dc987c542a1e9ae9f60ef25777
Opcode Fuzzy Hash: 2d3aef99367f62e0916239a7ec480fcbf2c425f3c8f74b6cff9783156f1ac1e1
Instruction Fuzzy Hash: 9D322270514B128FC338CF29C690A6ABBF1BF45710B644A2ED6A787B90D736F845DB24

Function 00E089A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbdfa1d188cee5dac74eb2d1a03db6f39b145ad7e051a61273dd6423ba92bf1
Instruction ID: 49b5ed7f064c709119d2aa2ec907f57d23f5b3854ba7370da35bcafc15e141ff
Opcode Fuzzy Hash: 5dbdfa1d188cee5dac74eb2d1a03db6f39b145ad7e051a61273dd6423ba92bf1
Instruction Fuzzy Hash: 2502AA75608341DFC704DF69E880A5AFBE1EF8A305F09896DE4C5A73A2C335D994CB92

Function 00E08A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b09cb520fa482fe2187d170f6b8695ad6850309dc2931c0ab487838b8b6ed0
Instruction ID: 1b370adddd0fad9b32791e7592811285fa1a94d72e2e9bfc7efda5683f366822
Opcode Fuzzy Hash: 39b09cb520fa482fe2187d170f6b8695ad6850309dc2931c0ab487838b8b6ed0
Instruction Fuzzy Hash: 80F19975608341DFC704DF69E88061EFBE1EB8A305F09892DE4D5A73A2D336D994CB92

Function 00E08C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06fe7edb445e3a4d953b4a0c50d1276e90724058db9c60ee20196b467508a295
Instruction ID: 59154052ae41fe901dd70f474a2d49ec8fbc7ca26b387fd7f81dd406f12a0018
Opcode Fuzzy Hash: 06fe7edb445e3a4d953b4a0c50d1276e90724058db9c60ee20196b467508a295
Instruction Fuzzy Hash: FCE1CE71608341CFC304DF29E88066AF7E1FB8A315F09896CE4D5A73A2D736D994CB92

Function 00DCA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 449d3e3b3b8252f1b66b3dd0579fa63148d46b7c50640e654b3be69b418e9a60
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: EFF1AE756087468FC724CF29C881B6BFBE2AFD8304F08882DE5D987751E635E945CB62

Function 00E08E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d96f805f51737196861e9a7401e01e8dc1ab7ea1cff67e74817448fdc409e027
Instruction ID: 9048a4fe23b3bb23a0f5464e37d17139be008ee7ada216a7f05fc9e7a2f99f00
Opcode Fuzzy Hash: d96f805f51737196861e9a7401e01e8dc1ab7ea1cff67e74817448fdc409e027
Instruction Fuzzy Hash: 48D1AD7460C341DFD304DF28D88062AFBE5EB8A305F09896CE4D5A73A2D736D894CB52

Function 00DD4487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515f411d889eda6d2bea7ccafef1002298822dd5b625610fd8824944a48d8c55
Instruction ID: e3b6c335bec70f7d8bae5bda2228cbd413e4374695d325d4aa8365536ddd8472
Opcode Fuzzy Hash: 515f411d889eda6d2bea7ccafef1002298822dd5b625610fd8824944a48d8c55
Instruction Fuzzy Hash: EDE1EFB5501B008FD325CF28D992B97BBE1FF06705F04886DE4AA87B52E735B854CB64

Function 00E07AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3770e32bb40515ffbd3339a9b3e74945c0541f5d8b7bb85699d3bc87feb8f3fb
Instruction ID: 9b96800cf05214d8342f6289636f3d02624de495c34ed7617a676cd153d64c70
Opcode Fuzzy Hash: 3770e32bb40515ffbd3339a9b3e74945c0541f5d8b7bb85699d3bc87feb8f3fb
Instruction Fuzzy Hash: 42B10372E0C3504BE314DA28CC85B6BB7E5EBC9314F08592DE9D9A73C2E635EC458792

Function 00DCAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: f06fdd4054acdd5a73c65a178bc88e9a1c64384b602e30df0752da83c53ad0e7
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 96C16D72A087418FC360CF68DC96BABB7E1BF85318F08492DD1D9C7242D778A155CB55

Function 00DD6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e87338b79f05808be7405af7b9e46e17797fdce59d24c362ed7b091b6cf30c8
Instruction ID: c6d071166e502fbc14e201d09e214b029ff8e90cfbae4ab50687018c3d471e80
Opcode Fuzzy Hash: 9e87338b79f05808be7405af7b9e46e17797fdce59d24c362ed7b091b6cf30c8
Instruction Fuzzy Hash: F7B101B4500B408BD3218F24D991B27BBF1EF46704F14885DE8AA8BB52E775F805CBA5

Function 00E07710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b08935a118c282fc72304cc26c24c860564e75f28854a84642366f889778da2c
Instruction ID: 0773af60519a37a1cf93b3aac05b71a9d9001a9e069b6590b138497e49aa8351
Opcode Fuzzy Hash: b08935a118c282fc72304cc26c24c860564e75f28854a84642366f889778da2c
Instruction Fuzzy Hash: 24919C71A08301ABE724DA14C881BABB7E5EB85354F54981DF8D4A73D1E730E980CBA2

Function 00E0A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b2a2d11eeee3030cf8ea178a244abd0a8536f7a1ea3670d7fe32b36db4626e
Instruction ID: 3c2fac61f101672be61f9385778b644146c205bcec72dec3a6d5d4b0af05f07d
Opcode Fuzzy Hash: 36b2a2d11eeee3030cf8ea178a244abd0a8536f7a1ea3670d7fe32b36db4626e
Instruction Fuzzy Hash: 4381AF352093058FD724DF28C880A2EB7F5EF99744F09992CE585A72A1E735EC90CB92

Function 00DF64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f469383aa6d5810bd951bb0e91feb85ddf6b8f257e7e7d4e1a9e0c0c39acf6e4
Instruction ID: 29aff09e280fe195417cacdf20ff36186a9a94cef0120110a1a2523466100d3b
Opcode Fuzzy Hash: f469383aa6d5810bd951bb0e91feb85ddf6b8f257e7e7d4e1a9e0c0c39acf6e4
Instruction Fuzzy Hash: FC71F833B29A944BC3149D7D5C423A5AA834BD6334B3EC379EAB4DB7E5D52ACC054360

Function 00DE28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201d44fc0b4f4551249a5ec965d10645ce295cf90cda2963c33e63c4b2f81287
Instruction ID: 3be052f6e75b6626dd8ba3056235cd6aac615a1e5ef9273bdb09017c6e0c69f3
Opcode Fuzzy Hash: 201d44fc0b4f4551249a5ec965d10645ce295cf90cda2963c33e63c4b2f81287
Instruction Fuzzy Hash: 1B6185B44183808BD310AF1AD891A2BBBF4EFA2750F18891CE5C59B261E379C910CB66

Function 00DE7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f9a3558c6d2b7b1cfb4d24d8710871fe02a8baa5f49c1cb10f1a87489cff48
Instruction ID: 9b80d075fdfce8d51c13db94b8af8f152f96630e5ebe140b0493a3383533eb1b
Opcode Fuzzy Hash: 91f9a3558c6d2b7b1cfb4d24d8710871fe02a8baa5f49c1cb10f1a87489cff48
Instruction Fuzzy Hash: 8C51D0B16082449BDB60AB25CC86BB733B8EF85754F184958F985CB290F375DC01C771

Function 00DF1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 89c01d8a35b136786e4aff457a5f763ff2b85cc06f89c6802ad4b8dc21de88ab
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 2161F335609309EBD714CE2CC58033FBBE2ABC5350F6AC92DE6D98B251D270DD829B51

Function 00DF82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f26e280d693b4182bfc522a1277a245ad828a41758ed7d1eb76a066f63df2d3
Instruction ID: d91d40edb03b44d6466bed482047553165745388a92a2d2afaa6c5477c7dfde6
Opcode Fuzzy Hash: 8f26e280d693b4182bfc522a1277a245ad828a41758ed7d1eb76a066f63df2d3
Instruction Fuzzy Hash: 02613623A1A9954BC314453D5C453BAAA831BD2330F3FC3669AF18B3F4C96A88456363

Function 00DD42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9380e99406c829472902ed2e6853d4941f81242d92adfd12f182bd5b00d0c6
Instruction ID: 6a816037764de2a83e7e6777781d918d80ed623accdc0ab6fbc816a9ae5b96b8
Opcode Fuzzy Hash: 6a9380e99406c829472902ed2e6853d4941f81242d92adfd12f182bd5b00d0c6
Instruction Fuzzy Hash: 7081D1B4810B00AFD360EF39D947757BEF4AB06201F404A2EE4EA97695E7306459CBE3

Function 00E6762B Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05170dea5ff015337ab8f6fe8dbbd7b8d97f988c5e7bb536b020fe1b70967b43
Instruction ID: eea18c5674aeb1151eecef443082f0934329cc3fc0ed22995a3fcd9de9424f5b
Opcode Fuzzy Hash: 05170dea5ff015337ab8f6fe8dbbd7b8d97f988c5e7bb536b020fe1b70967b43
Instruction Fuzzy Hash: F75146F3E092145BF704A92DDC9977AB68A9BE4321F2F8139DA8497784FC756C0542C2

Function 00DFE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: ac7f955f5524475a75a535f14da0efdd8a9f451607a17c3360dbcbcc2e09e5a6
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 5E516CB15083548FE314DF69D49436BBBE1BBC5318F054E2DE5E987390E379DA088B92

Function 00E07520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c58e278b48ce66ce2a58aae16e6550936b432be88ab7c5aede0d23a7aee892
Instruction ID: 8fafbf57b15a3a9d4827efe065818254acda6f0cfbe6cad6590966d3822722d1
Opcode Fuzzy Hash: f0c58e278b48ce66ce2a58aae16e6550936b432be88ab7c5aede0d23a7aee892
Instruction Fuzzy Hash: 8A512831A0C2009FC7159E18DC90B2EB7E6FB85358F289A2CE8D5673D1C632FC548B91

Function 00DC5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf71c99375e2a0c5a22bb08e974e9f430cc48aa889155d42b95e55b43c4b6f4
Instruction ID: 252e7055d7124e8408ec5288f12471bdb999b53bd78dd77da5b68beebde9fe6d
Opcode Fuzzy Hash: ddf71c99375e2a0c5a22bb08e974e9f430cc48aa889155d42b95e55b43c4b6f4
Instruction Fuzzy Hash: 6451D575A047069FC714DF14E890E26B7A1FF85324F19466CF89A8B356D631FC82CBA2

Function 0109D1A5 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae7371daa6cd5ef58fb3d5c4306979629f2d664ef5a7e01cca29723e4806680
Instruction ID: 4eb3f51b83eb513d35f1e2a92b64e3cb671479dcc5235c365931cc2443eb8a0f
Opcode Fuzzy Hash: fae7371daa6cd5ef58fb3d5c4306979629f2d664ef5a7e01cca29723e4806680
Instruction Fuzzy Hash: 7E5112B348C604EFC7406EA9DC5553EBBE4EB54320F56C92EE9C6C7600E6349841DB93

Function 00DEEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe15f8d15312c2e872a17c32fc37ffaa951a8b437a2bdd1a0638e97627c840fa
Instruction ID: 379d0fc568e6a90f88e44e118fb71d18e3dd4ba3c7798b0ae62583b4e3e2315e
Opcode Fuzzy Hash: fe15f8d15312c2e872a17c32fc37ffaa951a8b437a2bdd1a0638e97627c840fa
Instruction Fuzzy Hash: D3419E7490035ADFDF209F55DC91BA9B7B0FF0A300F184548E945BB3A1EB39A951CBA1

Function 00E09B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1e50e3218725e86deb6f178aa1eadc61a481a47c5673e4bed3533ad9eae4b5
Instruction ID: 976a0df511d8bba08509cc12c77d410476d92a9469717cdf5b6d03889288f57d
Opcode Fuzzy Hash: 3d1e50e3218725e86deb6f178aa1eadc61a481a47c5673e4bed3533ad9eae4b5
Instruction Fuzzy Hash: FE418B34608300AFE7109F15D9D1B2BF7E6EB85714F28982CF589A7293D371E881CB66

Function 00DD2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03de9c28665806a0ca3ecfddd6ebe3473e33d182c68f6d420d53ba50e7e8c608
Instruction ID: ee073663f0ee71e4ececad890426d3ef51380a3ef10c7420d9254d0e77068e4e
Opcode Fuzzy Hash: 03de9c28665806a0ca3ecfddd6ebe3473e33d182c68f6d420d53ba50e7e8c608
Instruction Fuzzy Hash: FB41F632A083654FD35CCF29889023ABBE2ABD5300F19C62FE4E6873D0DA748945D791

Function 00DD1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea87ae65e691d14c5687e8d5e426a9ca7c5437e7b6719baf7386ab04a9ee343
Instruction ID: c353068669f0b7f180b582947e8882db16ea2ab3f64d8d6f5211407fa64ed811
Opcode Fuzzy Hash: 6ea87ae65e691d14c5687e8d5e426a9ca7c5437e7b6719baf7386ab04a9ee343
Instruction Fuzzy Hash: 9E410F7550C380ABC320AB59C884B2EFBF5FB96354F14491DF6C497392C37AE8148B66

Function 00E08D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab27703c5d467d94743f671c359bebc12c28252b097d1b9d34360bd2672b935a
Instruction ID: 7becc71af1b118b88c7c8aa416b8c94465dc5b271d84bb3ad12e980cfeafacde
Opcode Fuzzy Hash: ab27703c5d467d94743f671c359bebc12c28252b097d1b9d34360bd2672b935a
Instruction Fuzzy Hash: DD41EF3160C3508FC304DF68C59052EFBEAAF99304F099A2DD4D5E72A1CB74DD458B82

Function 00DDD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bb8aed00f1077b7d69415cb4f3e1a98e6db58c31249354910995e35a5e9aa9
Instruction ID: ce642ea9ae628a3fba1d6061f9bc195beb3475f1eee6eaf66df89e7b6beeab2c
Opcode Fuzzy Hash: b7bb8aed00f1077b7d69415cb4f3e1a98e6db58c31249354910995e35a5e9aa9
Instruction Fuzzy Hash: 5841DCB16483818BD7309F14C885BABB3B1FFA6360F08495DE48A8B792E7754841CB63

Function 010BB3D2 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872140cfabece1e9931ff534456c96efc1b149c113da6007b27e43f73561a543
Instruction ID: 837aca5e1fd07af0616b1857f1748519802a2aa1a651171ee78fbf916cfd99a0
Opcode Fuzzy Hash: 872140cfabece1e9931ff534456c96efc1b149c113da6007b27e43f73561a543
Instruction Fuzzy Hash: B431D2F260C2008BD324BA29DCC57BEB7EAFB94310F16853CD6C69B748EA3558418697

Function 00DFF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 9a07b7929f1da603e135d972f15658b4df0f12cee2e2fb8bc52ccd350a5aa6e9
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: AB21F5329082284BC3249B5DC48163BF7E5EF99704F0BC62EEAC4A7295E7359C1487E5

Function 00E067EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93808a5aaf19148b84a046c149eecf795622627fba3455cfd4db2237ec527c84
Instruction ID: 5fe931911ec8f18228f3c93b63872031368796b1fcb4620eee269243bd25bb8c
Opcode Fuzzy Hash: 93808a5aaf19148b84a046c149eecf795622627fba3455cfd4db2237ec527c84
Instruction Fuzzy Hash: 9131287051C3829AD714CF14C49062FBBF0EF96788F54A80DF4C8AB2A1D338D995CB9A

Function 00DE5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc84e163ab83865e75510dd5a5700e8a905ace9f0b14828f0b84980899b52afd
Instruction ID: 4214050a33ba819ec30568d02d7a7b2c402833e9361b19735e744655eabf57e4
Opcode Fuzzy Hash: cc84e163ab83865e75510dd5a5700e8a905ace9f0b14828f0b84980899b52afd
Instruction Fuzzy Hash: 1D21B071508641DBC310AF29D85192BB7F4EF927A8F48890CF4D99B296E335CA00CBB3

Function 00DC49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 691ee77285e25e0563fffdc58b559d64e038de964c48ab0f8cecd434d0234cd4
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 0431E5316582129BD7109E58D8A0F2BB7E1EF8435CF1C892CE8DACB241D631DC42CB66

Function 00F010C1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f8c383fa133e23211dbb27cdcae40cdb55f087a44584badb803ed92b3a3399
Instruction ID: babe0352052d7c63cae660bf3130a5dd008187b06f3faca58a1393e3e9a38394
Opcode Fuzzy Hash: 66f8c383fa133e23211dbb27cdcae40cdb55f087a44584badb803ed92b3a3399
Instruction Fuzzy Hash: 932107F3E196004BF304D92AED85376B6DBDBD4331F3AC13DDA849A789F87958464288

Function 00E064B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90cc5a2adc9742809724f4245c02b7ea3030d719a69c5c6f9e604ca310d3032
Instruction ID: 7d7225517656908c709da7091a03176f7272281bcd173ba94d21c92f12813081
Opcode Fuzzy Hash: a90cc5a2adc9742809724f4245c02b7ea3030d719a69c5c6f9e604ca310d3032
Instruction Fuzzy Hash: D421397050C241DFD705EF19D480A2EFBE6FBD5745F18981CE4D4A72A1C335A8A4CB62

Function 00E05700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1e124fd29c3f78bf32ddf0079fe58dab921ebb25457811319623a1afa8c1ff
Instruction ID: c13f0e3eb89b54967b239992a451125d9e3a2e0da1ba68bd857bde851939195e
Opcode Fuzzy Hash: af1e124fd29c3f78bf32ddf0079fe58dab921ebb25457811319623a1afa8c1ff
Instruction Fuzzy Hash: 5C11A07191C240EBD301AF28E844A5BBBF5EF9A710F09982CE4C4AB2A1D335D854CB93

Function 00DFB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: ed80b973b79cefbd783b16d3ce97690cbfec434ce1b322bd5e620c77e7a9d4d6
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8611C633A051D90EC3168D3CC840575BFE31AA7234B5E839AE4B4DF2D2D7228D8A8364

Function 00DF0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: a9427f7de36a7955d78aca04086845ccdf053e3d3706127c9c93383d5b10bb92
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: D901B1F1A1030647E7209F5198D0B3BB6A8AF80718F1EC52CEB0A87203DB71EC06C6B1

Function 00DED1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249097f3f12a7c455d3810d381c10f59422490d36205a79b1d610283034bdf2b
Instruction ID: 32cb50d8f14137ade2c65988719aa55de90877002f41bf10c2bfa20f3b325881
Opcode Fuzzy Hash: 249097f3f12a7c455d3810d381c10f59422490d36205a79b1d610283034bdf2b
Instruction Fuzzy Hash: 2C11EFB0408380AFD310AF618584A2FFBE5EB96754F148C0DF6A49B251C775D819CF56

Function 00DC6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc6706f463f0b109606aa8830d0b2d63e9db7dce3aba0d5cee1c63ff0ea17b2
Instruction ID: 113c059465dde88afa61f3cbb2375abdaa60af41a7f2fb16077b5ab78f0a755a
Opcode Fuzzy Hash: 5cc6706f463f0b109606aa8830d0b2d63e9db7dce3aba0d5cee1c63ff0ea17b2
Instruction Fuzzy Hash: 18F0B43A71921A0FA610CDABA8C4D3BF396DBD9355B18553DEA41D3201DDB2E80691A0

Function 00DFB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00DDC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00DDB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 2da602897fc45d4e38a343457b6495e038043e133177002b418e552af01cb61c
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 12F0A7B160451497DB22CA589C80B3BBBDCCB9636CF1A0427E84557303D2615845C3F5

Function 00DF8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76276a7cdd457cad1e221d31b524aea345124b6d898382e3406636164696b46d
Instruction ID: e9ca87a704c7872f2de750e1995c73485a853d6111d9e40dd18641337849e322
Opcode Fuzzy Hash: 76276a7cdd457cad1e221d31b524aea345124b6d898382e3406636164696b46d
Instruction Fuzzy Hash: B201E4B04147009FD360EF29C886757BBE8EB48714F104A1DE8AECB680D771A588CB82

Function 00E01440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: cb58f98ce8386ee577bc0eca1e4dacdd9145138d3bce9fc60f2e59eaf909ae28
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 7DD0A73160832246DF748E19A400977F7F0EAC7B55F49A59EF596F7198D230DC81C2A9

Function 00DD1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c923a3e63067f13786ed4311e166813969a655e0e2e4208862e690b43f741e
Instruction ID: 18f72016a1e8f4dd568d244cb8a9569821e00544aede9055ac2b943a2a588712
Opcode Fuzzy Hash: 76c923a3e63067f13786ed4311e166813969a655e0e2e4208862e690b43f741e
Instruction Fuzzy Hash: 08C08C38A181008FC204CF02FCD5576B3B8E307308700B03AEE23F3B61CA20D82E8909

Function 00E06094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6c3a03d97dc47049396e63acc452432c8f8c10c2e684140bd779dd447b9bf9
Instruction ID: e04c48dfd2c906a07031f3458803a779de968e136da2afb293cc21448eaca3e4
Opcode Fuzzy Hash: cf6c3a03d97dc47049396e63acc452432c8f8c10c2e684140bd779dd447b9bf9
Instruction Fuzzy Hash: CBC04C3465C0008A9508CE1599518B5E2A69B97754724F019C84733295D128D916991C

Function 00DD1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4879dfc5fc77f0fb1d7c651d31a645ec7b1997dd72a90dc7636cc1e6b3d54e
Instruction ID: 88bf5e366009fdf20ece2ff01f847d511de0f1be28f811b153dccef3ca4bf0af
Opcode Fuzzy Hash: 7c4879dfc5fc77f0fb1d7c651d31a645ec7b1997dd72a90dc7636cc1e6b3d54e
Instruction Fuzzy Hash: C6C04C34A591408EC654CE86A8D1531A2A99306208710303ADA52F7661C561D4598509

Function 00E05FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2236687733.0000000000DC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000001.00000002.2236673831.0000000000DC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236735617.0000000000E20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236753285.0000000000E2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236767311.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236781261.0000000000E2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236884546.0000000000F88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236908273.0000000000F8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2236933194.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237052470.0000000000FA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237078069.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237130285.0000000000FB9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237150113.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237183041.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237203330.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237271874.0000000000FEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237293423.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237321444.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237340072.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237360905.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237379403.000000000101C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237398650.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237419243.0000000001022000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237439708.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237460103.000000000102C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237479138.000000000102D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237501811.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237523241.0000000001031000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237541559.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237564128.000000000103D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237582220.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237604256.0000000001046000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237624570.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237650210.0000000001068000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237668715.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237740955.000000000109E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237768178.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237796776.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237815569.00000000010BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237875345.00000000010CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2237900035.00000000010CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_dc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34f033e9bbad96eee5e61f7792e612d166a3dfd4d8e11434a99aa40dfd0a369
Instruction ID: 93850a4ed23bbf818cbc4698310632d2761942b3cb2b9ab9d0c699f25b6e1f28
Opcode Fuzzy Hash: f34f033e9bbad96eee5e61f7792e612d166a3dfd4d8e11434a99aa40dfd0a369
Instruction Fuzzy Hash: 4AC09234B6C0008FA64CCF2ADD51DB5F2FA9B8BB18B14F02DC807B3256E138D91A860C

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00DCFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00DCD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00E05BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00E0695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00DD049B Relevance: .3, Instructions: 264
COMMON

Function 00DD0228 Relevance: .2, Instructions: 218
COMMON

Function 00E099D0 Relevance: .1, Instructions: 143
COMMON

Function 00E03220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00E03202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON