Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542556
MD5:	86087e9d4fb4889f84248663397c20e8
SHA1:	f4522ba994cca26acd263ea74affcdcf08c28132
SHA256:	4b80ab722833213ebca9e444b7a197828d2dde267ea77a94921f1dd074ffe57c
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2012 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 86087E9D4FB4889F84248663397C20E8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["clearancek.site", "licendfilteo.site", "eaglepawnoy.store", "studennotediw.store", "spirittunek.store", "bathdoomgaz.store", "dissapoiznw.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.594197+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	53548	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.521391+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	59246	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.564381+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	64951	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.550885+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	55579	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.629722+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	53777	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.536435+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	60812	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.614443+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	51246	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:25.580472+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	62546	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T00:53:27.153450+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49711	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.2012.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["clearancek.site", "licendfilteo.site", "eaglepawnoy.store", "studennotediw.store", "spirittunek.store", "bathdoomgaz.store", "dissapoiznw.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006BD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006BD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_006F63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006F5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_006F695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_006F99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_006BFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_006C0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_006F4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_006C6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_006EF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_006B1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_006F6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_006DD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_006D2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_006D2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_006C42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_006BA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_006DC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_006F1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_006CD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_006DE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_006CB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_006F64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_006F7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_006C6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_006D9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_006B8590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_006DE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_006EB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_006F7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_006F67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_006DD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_006D28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_006CD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_006F3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_006B49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_006F4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_006B5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_006C1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_006C1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_006CDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_006CDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_006F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_006C1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_006C3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_006E0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_006DEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_006EFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_006D7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006F9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_006F9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_006DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_006DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_006DAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_006DAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_006DDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_006DFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006F8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_006D7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006D5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_006DAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_006C4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_006B6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_006C6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_006BBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_006C1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_006D9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006EFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_006F7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006F7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_006CFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_006F5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_006B8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_006C6F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:60812 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:53548 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:59246 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:53777 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:51246 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:64951 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:62546 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:55579 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49711 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: mobbipenju.store

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: eampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; ou equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mpowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://meda% equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dY1
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloU
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunit
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187739823.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&a
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2183963424.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188025122.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/5
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.2183963424.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188025122.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;5
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.come
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/re
Source: file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0228	0_2_006C0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F4040	0_2_006F4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C2030	0_2_006C2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B1000	0_2_006B1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FA0D0	0_2_006FA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B5160	0_2_006B5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00976198	0_2_00976198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924186	0_2_00924186
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B71F0	0_2_006B71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BE1A0	0_2_006BE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B12F7	0_2_006B12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E82D0	0_2_006E82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E12D0	0_2_006E12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088C3B4	0_2_0088C3B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BA300	0_2_006BA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087D30C	0_2_0087D30C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E23E0	0_2_006E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B13A3	0_2_006B13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BB3A0	0_2_006BB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DC470	0_2_006DC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008784DB	0_2_008784DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B5403	0_2_007B5403
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E64F0	0_2_006E64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088245F	0_2_0088245F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00889456	0_2_00889456
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C4487	0_2_006C4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C049B	0_2_006C049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CC5F0	0_2_006CC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082F531	0_2_0082F531
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B35B0	0_2_006B35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B8590	0_2_006B8590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B164F	0_2_006B164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F8652	0_2_006F8652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EF620	0_2_006EF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F86F0	0_2_006F86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E1860	0_2_006E1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BA850	0_2_006BA850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087B8D7	0_2_0087B8D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088A8E1	0_2_0088A8E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EB8C0	0_2_006EB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE8A0	0_2_006EE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F89A0	0_2_006F89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D098B	0_2_006D098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F4A40	0_2_006F4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7AB0	0_2_006F7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F8A80	0_2_006F8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CDB6F	0_2_006CDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B7BF0	0_2_006B7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F8C02	0_2_006F8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DCCD0	0_2_006DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F6CBF	0_2_006F6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D8D62	0_2_006D8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087EDAB	0_2_0087EDAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DDD29	0_2_006DDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DFD10	0_2_006DFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F8E70	0_2_006F8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DAE57	0_2_006DAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C4E2A	0_2_006C4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00879EED	0_2_00879EED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00887E29	0_2_00887E29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C6EBF	0_2_006C6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BBEB0	0_2_006BBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876FE7	0_2_00876FE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BAF10	0_2_006BAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A1FD8	0_2_007A1FD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7FC0	0_2_006F7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B8FD0	0_2_006B8FD0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006CD300 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006BCAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9995681208745875

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E8220 CoCreateInstance,

0_2_006E8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 2952704 > 1048576

Source: file.exe

Static PE information: Raw size of bpbmqxys is bigger than: 0x100000 < 0x2a7600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.6b0000.0.unpack :EW;.rsrc :W;.idata :W;bpbmqxys:EW;bdkynqtj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;bpbmqxys:EW;bdkynqtj:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2d8a6a should be: 0x2dc5f5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: bpbmqxys
Source: file.exe	Static PE information: section name: bdkynqtj
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009330F5 push edi; mov dword ptr [esp], esp	0_2_00933185
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009330F5 push esi; mov dword ptr [esp], ecx	0_2_009331B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8000 push 3126ACEFh; mov dword ptr [esp], ebx	0_2_009B8030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8000 push eax; mov dword ptr [esp], 7EDDA792h	0_2_009B80F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8000 push edx; mov dword ptr [esp], 61E53F11h	0_2_009B8114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8000 push 2057C9AFh; mov dword ptr [esp], ebx	0_2_009B8159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B803F push eax; mov dword ptr [esp], 7EDDA792h	0_2_009B80F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B803F push edx; mov dword ptr [esp], 61E53F11h	0_2_009B8114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B803F push 2057C9AFh; mov dword ptr [esp], ebx	0_2_009B8159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B819B push esi; mov dword ptr [esp], 4FBBE5BCh	0_2_009B81C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B819B push edx; mov dword ptr [esp], esi	0_2_009B8201
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B819B push edi; mov dword ptr [esp], 3BC7E1B7h	0_2_009B820F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00976198 push ebp; mov dword ptr [esp], eax	0_2_0097631F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00976198 push edi; mov dword ptr [esp], esp	0_2_009764D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924186 push 08870A92h; mov dword ptr [esp], ebp	0_2_00924192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924186 push esi; mov dword ptr [esp], ecx	0_2_0092428E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00903176 push edx; mov dword ptr [esp], ecx	0_2_00903126
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00903176 push 736F5B31h; mov dword ptr [esp], eax	0_2_009031C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00903176 push eax; mov dword ptr [esp], edi	0_2_00903274
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AA162 push 5F1C9939h; mov dword ptr [esp], esi	0_2_008AA16A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075327F push 6E7F4169h; mov dword ptr [esp], edi	0_2_007532B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075327F push edx; mov dword ptr [esp], esi	0_2_007532C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FF249 push edx; ret	0_2_006FF24B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084F2E4 push edx; mov dword ptr [esp], eax	0_2_0084F381
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084F2E4 push esi; mov dword ptr [esp], edx	0_2_0084F40D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084F2E4 push eax; mov dword ptr [esp], edi	0_2_0084F499
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084F2E4 push 657F655Eh; mov dword ptr [esp], ebp	0_2_0084F4C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098A2F4 push edi; mov dword ptr [esp], 565AE0FAh	0_2_0098A317
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008EB229 push 57143301h; mov dword ptr [esp], edi	0_2_008EB231
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC239 push edx; mov dword ptr [esp], 5B06D850h	0_2_008AC261
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC239 push 5C3BADF0h; mov dword ptr [esp], esi	0_2_008AC308

Source: file.exe

Static PE information: section name: entropy: 7.981117107754053

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713DEA second address: 713DF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713DF0 second address: 713DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8911BD second address: 8911E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FC108864666h 0x00000011 jmp 00007FC108864672h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8911E0 second address: 8911EB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893134 second address: 893138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893138 second address: 893174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 mov si, EAC1h 0x0000000c push 00000000h 0x0000000e call 00007FC1088679E4h 0x00000013 jl 00007FC1088679DCh 0x00000019 mov dword ptr [ebp+122D35B1h], eax 0x0000001f pop edx 0x00000020 push EAF2F3DFh 0x00000025 pushad 0x00000026 push esi 0x00000027 push eax 0x00000028 pop eax 0x00000029 pop esi 0x0000002a push esi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8932AD second address: 8932B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FC108864666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8932B8 second address: 89333C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnc 00007FC1088679F3h 0x0000000e nop 0x0000000f or dword ptr [ebp+122D34CCh], ebx 0x00000015 cmc 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FC1088679D8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 sub dword ptr [ebp+122D1C9Dh], edx 0x00000038 call 00007FC1088679D9h 0x0000003d pushad 0x0000003e jno 00007FC1088679DCh 0x00000044 pushad 0x00000045 jmp 00007FC1088679DCh 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89333C second address: 89336D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jng 00007FC108864666h 0x00000011 popad 0x00000012 jmp 00007FC108864674h 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89336D second address: 893393 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FC1088679DBh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893393 second address: 8933E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop eax 0x00000008 or dword ptr [ebp+122D2ADCh], esi 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FC108864668h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a clc 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D36BDh], eax 0x00000033 push 00000003h 0x00000035 push esi 0x00000036 mov dword ptr [ebp+122D26E0h], ebx 0x0000003c pop esi 0x0000003d push 67A7B96Bh 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FC10886466Ah 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8933E7 second address: 8933EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8933EC second address: 893448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 58584695h 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FC108864668h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 jmp 00007FC10886466Fh 0x0000002d adc si, 2F5Dh 0x00000032 lea ebx, dword ptr [ebp+12452FE4h] 0x00000038 je 00007FC108864672h 0x0000003e jne 00007FC10886466Ch 0x00000044 xchg eax, ebx 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893448 second address: 89346D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC1088679DAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89346D second address: 893477 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC108864666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8934E0 second address: 8934EA instructions: 0x00000000 rdtsc 0x00000002 js 00007FC1088679DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8934EA second address: 893580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D1C5Ah], ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FC108864668h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push A2475B7Dh 0x00000030 push edx 0x00000031 jmp 00007FC10886466Ah 0x00000036 pop edx 0x00000037 add dword ptr [esp], 5DB8A503h 0x0000003e push 00000000h 0x00000040 push esi 0x00000041 call 00007FC108864668h 0x00000046 pop esi 0x00000047 mov dword ptr [esp+04h], esi 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc esi 0x00000054 push esi 0x00000055 ret 0x00000056 pop esi 0x00000057 ret 0x00000058 push 00000003h 0x0000005a and di, 8B58h 0x0000005f push 00000000h 0x00000061 mov dword ptr [ebp+122D34C6h], ecx 0x00000067 push 00000003h 0x00000069 mov dword ptr [ebp+122D385Dh], ecx 0x0000006f call 00007FC108864669h 0x00000074 push eax 0x00000075 push edx 0x00000076 jp 00007FC10886466Ch 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893580 second address: 8935B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC1088679DDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 jbe 00007FC1088679E0h 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 push eax 0x00000022 pop eax 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8935B6 second address: 8935ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jng 00007FC108864668h 0x00000012 push eax 0x00000013 jmp 00007FC10886466Ch 0x00000018 pop eax 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pushad 0x00000022 popad 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8935ED second address: 8935FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1088679DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B215E second address: 8B2162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2162 second address: 8B2168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2168 second address: 8B2175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 ja 00007FC108864666h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2175 second address: 8B2183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC1088679D6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B22DC second address: 8B22E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B22E6 second address: 8B22F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC1088679D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FC1088679D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B22F9 second address: 8B22FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B25A4 second address: 8B25AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2702 second address: 8B2706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2706 second address: 8B270E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2B83 second address: 8B2B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC10886466Ah 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2FA3 second address: 8B2FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B322A second address: 8B322E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B322E second address: 8B3232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3232 second address: 8B3238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88BF4D second address: 88BF53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3BD7 second address: 8B3BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3F8A second address: 8B3F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3F90 second address: 8B3FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC10886466Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3FA5 second address: 8B3FA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BBCA6 second address: 8BBCAB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BBCAB second address: 8BBCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FC1088679E5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BBCCD second address: 8BBCD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BBCD2 second address: 8BBCD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BAD8E second address: 8BADC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC108864676h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC108864673h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C06E1 second address: 8C06E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C06E5 second address: 8C0711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC108864670h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FC10886466Ch 0x00000010 pop ecx 0x00000011 jng 00007FC10886469Eh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFB94 second address: 8BFB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFB9A second address: 8BFBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 je 00007FC10886466Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFBA9 second address: 8BFBDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FC1088679FCh 0x0000000d jmp 00007FC1088679DFh 0x00000012 jmp 00007FC1088679E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFEDF second address: 8BFEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFEE4 second address: 8BFEEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C03E1 second address: 8C03E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C03E7 second address: 8C03EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C03EB second address: 8C0404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC108864670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0586 second address: 8C05B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC1088679E8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FC1088679DCh 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0E24 second address: 8C0E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0E2B second address: 8C0E30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0E30 second address: 8C0E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0E36 second address: 8C0E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 57773F98h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FC1088679D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 0497388Dh 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FC1088679E8h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0F8F second address: 8C0FB4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC108864668h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC108864676h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C10D6 second address: 8C10DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C13E8 second address: 8C13F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FC108864666h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C13F6 second address: 8C13FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1CCE second address: 8C1CD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1CD3 second address: 8C1CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1FFF second address: 8C2003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2003 second address: 8C200E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2F8E second address: 8C2F92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C57F1 second address: 8C57F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C57F9 second address: 8C5809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 jnp 00007FC10886466Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5809 second address: 8C5884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007FC1088679D8h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 00000016h 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 mov edi, dword ptr [ebp+122D273Eh] 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007FC1088679D8h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D3A7Ch] 0x00000048 push 00000000h 0x0000004a mov dword ptr [ebp+122D2932h], esi 0x00000050 push edx 0x00000051 pop edi 0x00000052 xchg eax, ebx 0x00000053 jmp 00007FC1088679E4h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push esi 0x0000005c jc 00007FC1088679D6h 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBFFA second address: 8CBFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBFFE second address: 8CC01C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC01C second address: 8CC07B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC108864668h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FC108864668h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push 00000000h 0x00000027 stc 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007FC108864668h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 push eax 0x00000045 mov edi, 4E3448E4h 0x0000004a pop ebx 0x0000004b xchg eax, esi 0x0000004c push ecx 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD1B1 second address: 8CD1B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD1B7 second address: 8CD1BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B2D second address: 8C6B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B31 second address: 8C6B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF34F second address: 8CF353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0390 second address: 8D0395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0395 second address: 8D039F instructions: 0x00000000 rdtsc 0x00000002 je 00007FC1088679DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D246B second address: 8D2474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2474 second address: 8D247A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D247A second address: 8D248F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D29F5 second address: 8D2A00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FC1088679D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9755 second address: 8C9759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4ACD second address: 8D4AD7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC1088679D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4AD7 second address: 8D4AFC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC108864675h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c js 00007FC108864674h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4AFC second address: 8D4B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC1088679D6h 0x0000000a popad 0x0000000b nop 0x0000000c cmc 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+122D21F6h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FC1088679D8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FC1088679DFh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4B4A second address: 8D4B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6CBF second address: 8D6CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC1F8 second address: 8CC1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6CD1 second address: 8D6CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FC1088679D8h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD332 second address: 8CD336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC1FC second address: 8CC202 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0601 second address: 8D0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6CE4 second address: 8D6CEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2B81 second address: 8D2B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4C92 second address: 8D4C9C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC1088679D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0605 second address: 8D060A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2B91 second address: 8D2C28 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e jmp 00007FC1088679E2h 0x00000013 popad 0x00000014 nop 0x00000015 jmp 00007FC1088679E2h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov edi, dword ptr [ebp+122D3A7Ch] 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007FC1088679D8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 jp 00007FC1088679DEh 0x0000004e mov eax, dword ptr [ebp+122D00C5h] 0x00000054 mov dword ptr [ebp+122D26A8h], edi 0x0000005a push FFFFFFFFh 0x0000005c mov ebx, 585AA277h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jng 00007FC1088679DCh 0x0000006a jng 00007FC1088679D6h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4C9C second address: 8D4D55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC108864675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FC108864671h 0x00000010 jmp 00007FC108864673h 0x00000015 popad 0x00000016 nop 0x00000017 stc 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007FC108864668h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 call 00007FC108864674h 0x0000003e sub dword ptr [ebp+122D3609h], ebx 0x00000044 pop edi 0x00000045 mov dword ptr fs:[00000000h], esp 0x0000004c cld 0x0000004d mov eax, dword ptr [ebp+122D08BDh] 0x00000053 jmp 00007FC108864673h 0x00000058 push FFFFFFFFh 0x0000005a and edi, dword ptr [ebp+122D2A45h] 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 je 00007FC108864666h 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7D2E second address: 8D7D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2C28 second address: 8D2C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC10886466Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4D55 second address: 8D4D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8C8D second address: 8D8C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 ja 00007FC108864666h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DACE2 second address: 8DACED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC1088679D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DACED second address: 8DACF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FC108864666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DADC2 second address: 8DADC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DBDF3 second address: 8DBDF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DBDF9 second address: 8DBE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jnp 00007FC1088679E2h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FC1088679D8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D2B45h], ecx 0x00000030 mov bx, ax 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+12461719h], edx 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e jmp 00007FC1088679E1h 0x00000043 pop eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCF51 second address: 8DCF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCF55 second address: 8DCF59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCF59 second address: 8DCF63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCF63 second address: 8DCFA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a cld 0x0000000b push 00000000h 0x0000000d mov edi, dword ptr [ebp+122D35BFh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FC1088679D8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push eax 0x00000030 je 00007FC1088679E9h 0x00000036 push eax 0x00000037 push edx 0x00000038 push edi 0x00000039 pop edi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7EA7 second address: 8D7EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8E77 second address: 8D8E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAF11 second address: 8DAF15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6F81 second address: 8D6FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FC1088679EDh 0x0000000d jmp 00007FC1088679E7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8E7B second address: 8D8E7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAF15 second address: 8DAF19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF54A second address: 8DF550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF550 second address: 8DF571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FC1088679D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5CF4 second address: 8D5D1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jng 00007FC108864666h 0x00000010 jmp 00007FC108864675h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8F22 second address: 8D8F4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC1088679E3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jng 00007FC1088679D8h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF571 second address: 8DF575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8F4B second address: 8D8F4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC08B second address: 8DC08F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF575 second address: 8DF587 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5DEA second address: 8D5DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC17E second address: 8DC188 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC1088679D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B2A second address: 8E8B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC108864674h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B42 second address: 8E8B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B59 second address: 8E8B6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B6D second address: 8E8B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E832F second address: 8E833B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E833B second address: 8E833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E848A second address: 8E848E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E85E4 second address: 8E85F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E85F0 second address: 8E85F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E85F4 second address: 8E85FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ECBFA second address: 8ECC2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC108864671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FC108864671h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F26FD second address: 8F270F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC1088679D6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F135D second address: 8F1363 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1363 second address: 8F137D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007FC1088679DEh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1988 second address: 8F1994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1B4B second address: 8F1B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1B51 second address: 8F1B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1CDC second address: 8F1CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F20D3 second address: 8F20E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FC10886466Eh 0x0000000b jp 00007FC108864666h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F20E6 second address: 8F20F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679DBh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F2241 second address: 8F2245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5A43 second address: 8F5A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC1088679E1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8E65 second address: 8F8E69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8E69 second address: 8F8E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8E75 second address: 8F8E9D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC108864666h 0x00000008 js 00007FC108864666h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jc 00007FC108864666h 0x0000001c jl 00007FC108864666h 0x00000022 popad 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8E9D second address: 8F8EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8EB2 second address: 8F8EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC108864671h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8EC9 second address: 8F8ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8ECD second address: 8F8EDB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC108864666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8EDB second address: 8F8EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA13A second address: 8CA13E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA648 second address: 8CA66A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FC1088679E0h 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA66A second address: 8CA66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAB17 second address: 8CAB1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAB1C second address: 8CAB3B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC10886466Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FC10886466Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAF39 second address: 8CAF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAF3D second address: 8CAF4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB1DD second address: 8CB1EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FC1088679D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB2B2 second address: 8CB366 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC108864668h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FC108864675h 0x00000012 nop 0x00000013 jmp 00007FC108864671h 0x00000018 lea eax, dword ptr [ebp+12489DCEh] 0x0000001e push ecx 0x0000001f mov cx, 8329h 0x00000023 pop edi 0x00000024 push eax 0x00000025 jnl 00007FC108864675h 0x0000002b mov dword ptr [esp], eax 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FC108864668h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov edx, dword ptr [ebp+122D2754h] 0x0000004e lea eax, dword ptr [ebp+12489D8Ah] 0x00000054 push 00000000h 0x00000056 push esi 0x00000057 call 00007FC108864668h 0x0000005c pop esi 0x0000005d mov dword ptr [esp+04h], esi 0x00000061 add dword ptr [esp+04h], 00000018h 0x00000069 inc esi 0x0000006a push esi 0x0000006b ret 0x0000006c pop esi 0x0000006d ret 0x0000006e mov dl, bh 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jnp 00007FC108864668h 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB366 second address: 8AA0B0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007FC1088679D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D30F9h], ebx 0x00000015 call dword ptr [ebp+12462678h] 0x0000001b jg 00007FC1088679FDh 0x00000021 push edi 0x00000022 push esi 0x00000023 pushad 0x00000024 popad 0x00000025 pop esi 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA0B0 second address: 8AA0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F97EB second address: 8F97F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA08B second address: 8AA0B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Fh 0x00000007 jmp 00007FC10886466Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9021AA second address: 9021B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90231E second address: 90233B instructions: 0x00000000 rdtsc 0x00000002 js 00007FC108864666h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 ja 00007FC108864676h 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90194A second address: 90194E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 902B93 second address: 902BB5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC108864666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FC108864675h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 902BB5 second address: 902BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 902BC0 second address: 902BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907789 second address: 907793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC1088679D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907793 second address: 907797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907D3B second address: 907D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC1088679D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907D45 second address: 907D4B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907D4B second address: 907D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907D51 second address: 907D6E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC108864668h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC10886466Fh 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90843D second address: 908441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908441 second address: 908447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906DED second address: 906E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E5h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877FDD second address: 877FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B73B second address: 90B761 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC1088679E6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FC1088679D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B761 second address: 90B765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B8A5 second address: 90B8AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90EA7D second address: 90EA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90EA86 second address: 90EAC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC1088679E6h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FC1088679E9h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90EAC6 second address: 90EACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90EACC second address: 90EAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90EAD2 second address: 90EAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E4DB second address: 90E506 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC1088679D6h 0x00000008 jnc 00007FC1088679D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC1088679E7h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E506 second address: 90E50A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E50A second address: 90E510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912060 second address: 912070 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC108864666h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912070 second address: 912083 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC1088679DEh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9125BC second address: 9125DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC10886466Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC10886466Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9125DA second address: 9125DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9125DE second address: 9125E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9125E4 second address: 9125E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916B64 second address: 916B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916E5E second address: 916E76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC1088679D6h 0x00000008 je 00007FC1088679D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FC1088679E2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917009 second address: 917016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917016 second address: 91701A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9171B8 second address: 9171CC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC10886466Eh 0x00000008 jno 00007FC108864666h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9171CC second address: 9171D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9171D0 second address: 9171D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91CBF0 second address: 91CBF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91CBF4 second address: 91CBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91CBFA second address: 91CBFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91CBFF second address: 91CC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC108864666h 0x0000000a jmp 00007FC10886466Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC108864673h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91CC2C second address: 91CC30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91BFC2 second address: 91BFD2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC10886466Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C7F4 second address: 91C7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C7FD second address: 91C807 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC108864666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922603 second address: 922607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922607 second address: 922630 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FC10886467Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FC108864666h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9236E4 second address: 9236F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC1088679D6h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9236F3 second address: 923703 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC108864666h 0x0000000a jno 00007FC108864666h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923703 second address: 923709 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92398A second address: 923994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC108864666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92895A second address: 92897A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679E6h 0x00000007 jc 00007FC1088679DEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927A93 second address: 927A9D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC108864666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927A9D second address: 927AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FC1088679F5h 0x0000000c jmp 00007FC1088679E6h 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop ebx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FC1088679DAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927EE7 second address: 927EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92817B second address: 928198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1088679E7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928198 second address: 92819C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928595 second address: 9285B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9285B1 second address: 9285DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007FC108864666h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007FC108864666h 0x00000017 jmp 00007FC108864675h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9285DD second address: 928608 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679E3h 0x00000007 jmp 00007FC1088679E4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9331D1 second address: 9331D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9331D7 second address: 9331E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9331E2 second address: 9331EE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC108864666h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9331EE second address: 93320C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007FC1088679D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC1088679DDh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93335E second address: 933380 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC108864666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC108864673h 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9334AE second address: 9334BA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9334BA second address: 9334CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC10886466Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9334CD second address: 933500 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC1088679DEh 0x0000000e js 00007FC1088679DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933500 second address: 933514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jo 00007FC108864666h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933514 second address: 933518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933518 second address: 933528 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC108864666h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933528 second address: 93352E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93352E second address: 933532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93393B second address: 933945 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC1088679D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933945 second address: 933955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933955 second address: 933959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933959 second address: 933989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC10886466Dh 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e jmp 00007FC10886466Eh 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 pushad 0x00000017 jl 00007FC108864666h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933AE1 second address: 933AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933AE5 second address: 933AEB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934366 second address: 93436B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93436B second address: 934380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC10886466Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C6F2 second address: 93C6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C127 second address: 93C136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FC108864666h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C136 second address: 93C13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C13A second address: 93C153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FC10886466Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jns 00007FC108864666h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C2BC second address: 93C2E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FC1088679E0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94818A second address: 948190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948190 second address: 948194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A298 second address: 94A29E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C9B9 second address: 94C9BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C9BF second address: 94C9CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953AF6 second address: 953AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953AFF second address: 953B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953B05 second address: 953B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953B09 second address: 953B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953B1A second address: 953B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953B35 second address: 953B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960612 second address: 960631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1088679E9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960631 second address: 960636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960636 second address: 96064A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC1088679DDh 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96636C second address: 9663A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FC108864666h 0x00000009 pop esi 0x0000000a jmp 00007FC108864670h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 je 00007FC108864697h 0x00000017 pushad 0x00000018 jmp 00007FC108864673h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9666C8 second address: 9666F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FC1088679E9h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9666F4 second address: 9666F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 966CA7 second address: 966CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9678AB second address: 9678AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E20D second address: 96E218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E218 second address: 96E240 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC108864666h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FC108864680h 0x00000012 jmp 00007FC108864674h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E08D second address: 96E091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97721D second address: 977238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC108864671h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BC71 second address: 98BC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BC75 second address: 98BC79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5565 second address: 9A5572 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC1088679D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A45E2 second address: 9A45E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A45E7 second address: 9A45F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FC1088679D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4769 second address: 9A476D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A476D second address: 9A4773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4F39 second address: 9A4F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5225 second address: 9A522E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6BF7 second address: 9A6C05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FC108864666h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6C05 second address: 9A6C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6C09 second address: 9A6C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jne 00007FC108864666h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 je 00007FC108864666h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAB04 second address: 9AAB09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAD5A second address: 9AAD5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB138 second address: 9AB13E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB13E second address: 9AB142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB142 second address: 9AB146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB146 second address: 9AB174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007FC10886467Ch 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB174 second address: 9AB179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB179 second address: 9AB183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FC108864666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA8E second address: 9ACA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA92 second address: 9ACA98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA98 second address: 9ACAB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jc 00007FC1088679D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACAB4 second address: 9ACAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACAB9 second address: 9ACABE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACABE second address: 9ACAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACAC4 second address: 9ACACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC5FD second address: 9AC625 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC108864666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FC10886466Eh 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC10886466Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC625 second address: 9AC629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC629 second address: 9AC62F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC62F second address: 9AC64F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC1088679E2h 0x0000000d ja 00007FC1088679D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC64F second address: 9AC653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0C87 second address: 49E0C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0C8D second address: 49E0C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0C91 second address: 49E0CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, 328A546Fh 0x00000012 pushfd 0x00000013 jmp 00007FC1088679E4h 0x00000018 or si, 8098h 0x0000001d jmp 00007FC1088679DBh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0CCA second address: 49E0CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0CD0 second address: 49E0CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0CD4 second address: 49E0D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FC108864695h 0x0000000e jmp 00007FC108864677h 0x00000013 add eax, ecx 0x00000015 jmp 00007FC108864676h 0x0000001a mov eax, dword ptr [eax+00000860h] 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FC10886466Eh 0x00000027 sub si, F488h 0x0000002c jmp 00007FC10886466Bh 0x00000031 popfd 0x00000032 jmp 00007FC108864678h 0x00000037 popad 0x00000038 test eax, eax 0x0000003a jmp 00007FC108864670h 0x0000003f je 00007FC17A7BA662h 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FC108864677h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0D82 second address: 49E0DA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1088679E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [eax+04h], 00000005h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0DA9 second address: 49E0DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0DAD second address: 49E0DB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0DB3 second address: 49E0DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0DB9 second address: 49E0DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0DBD second address: 49E0DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 713E40 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 713D97 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8E3582 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 93DA69 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00717743 rdtsc

0_2_00717743

Source: C:\Users\user\Desktop\file.exe TID: 4508

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: file.exe, 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2187085128.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPh
Source: file.exe, 00000000.00000002.2188025122.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000D37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2183963424.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188025122.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00717743 rdtsc

0_2_00717743

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F5BB0 LdrInitializeThunk,

0_2_006F5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store
Source: file.exe	String found in binary or memory: mobbipenju.store

Source: file.exe	Binary or memory string: >CVProgram Manager
Source: file.exe, 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: CVProgram Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
sergei-esenin.com	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
studennotediw.store	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
eaglepawnoy.store	true	unknown
bathdoomgaz.store	true	unknown
clearancek.site	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dY1	file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000000.00000003.2183963424.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188025122.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.cloU	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gstatic.cn/re	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunit	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/5	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.2183771496.0000000000D7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187739823.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.come	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183809241.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&a	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st	file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000002.2188873162.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2187085128.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/api	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/badges	file.exe, 00000000.00000003.2183771496.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2188824132.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184045617.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542556
Start date and time:	2024-10-26 00:52:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:53:25	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	23.38.140.131
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	23.207.45.238
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	23.38.98.201
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Fanduel CO Player Location Check F.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	1.zip	Get hash	malicious	Unknown	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.DropperX-gen.11055.6641.exe	Get hash	malicious	BlackMoon	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5222097489550315
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'952'704 bytes
MD5:	86087e9d4fb4889f84248663397c20e8
SHA1:	f4522ba994cca26acd263ea74affcdcf08c28132
SHA256:	4b80ab722833213ebca9e444b7a197828d2dde267ea77a94921f1dd074ffe57c
SHA512:	ffb24e8cc8dfeefd2514d829b3061ecad32040b6887d1461ec1c2c0e3e8668968c6658937938826873e3d58550007135b1c3d3ceebb33a4f5d73eda52548061d
SSDEEP:	49152:o2ASFbqOaODpwQI+4y/29YcXGnD3hhwlk:0SxqOaMwt+4AcXGTzwC
TLSH:	4FD54991B549B2CFD58F27B8442BCEC65E5D03B94B1208C7A93974BA6F73CC215BAC24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....j.-...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x709000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC10889066Ah
paddsb mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC108892665h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	9cb02e46edefe0a1eca61e83eefb6f13	False	0.9995681208745875	data	7.981117107754053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bpbmqxys	0x60000	0x2a8000	0x2a7600	5319b8cd1afbf535e9b4bf5a265e0bee	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bdkynqtj	0x308000	0x1000	0x600	929a6367943ebf16da1cee378020947a	False	0.556640625	data	4.903702216130627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x309000	0x3000	0x2200	6a53577602e5d45637bfde2f16bcbecd	False	0.09627757352941177	DOS executable (COM)	1.0429102766965646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T00:53:25.521391+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	59246	1.1.1.1	53	UDP
2024-10-26T00:53:25.536435+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	60812	1.1.1.1	53	UDP
2024-10-26T00:53:25.550885+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	55579	1.1.1.1	53	UDP
2024-10-26T00:53:25.564381+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	64951	1.1.1.1	53	UDP
2024-10-26T00:53:25.580472+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	62546	1.1.1.1	53	UDP
2024-10-26T00:53:25.594197+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	53548	1.1.1.1	53	UDP
2024-10-26T00:53:25.614443+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	51246	1.1.1.1	53	UDP
2024-10-26T00:53:25.629722+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	53777	1.1.1.1	53	UDP
2024-10-26T00:53:27.153450+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49711	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 00:53:25.661629915 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:25.661689997 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:25.661815882 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:25.665174961 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:25.665195942 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:26.513995886 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:26.514074087 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:26.516479969 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:26.516503096 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:26.516817093 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:26.559793949 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:26.568645954 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:26.615355968 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153451920 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153479099 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153515100 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153537989 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153557062 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153742075 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.153769970 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.153842926 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.269367933 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.269413948 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.269675016 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.269697905 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.269788980 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.269815922 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.269925117 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.269963026 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.269963026 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.272578955 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.272579908 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 26, 2024 00:53:27.272615910 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 26, 2024 00:53:27.272630930 CEST	443	49711	104.102.49.254	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 00:53:25.521390915 CEST	59246	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.532830000 CEST	53	59246	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.536434889 CEST	60812	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.546880007 CEST	53	60812	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.550884962 CEST	55579	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.561333895 CEST	53	55579	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.564380884 CEST	64951	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.577673912 CEST	53	64951	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.580471992 CEST	62546	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.591475010 CEST	53	62546	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.594197035 CEST	53548	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.611376047 CEST	53	53548	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.614443064 CEST	51246	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.626760960 CEST	53	51246	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.629722118 CEST	53777	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.640600920 CEST	53	53777	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:25.645723104 CEST	58090	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:25.656007051 CEST	53	58090	1.1.1.1	192.168.2.6
Oct 26, 2024 00:53:27.274912119 CEST	62238	53	192.168.2.6	1.1.1.1
Oct 26, 2024 00:53:27.308957100 CEST	53	62238	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 00:53:25.521390915 CEST	192.168.2.6	1.1.1.1	0x5a9a	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.536434889 CEST	192.168.2.6	1.1.1.1	0x8f03	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.550884962 CEST	192.168.2.6	1.1.1.1	0xcc10	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.564380884 CEST	192.168.2.6	1.1.1.1	0x285f	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.580471992 CEST	192.168.2.6	1.1.1.1	0xa110	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.594197035 CEST	192.168.2.6	1.1.1.1	0x6924	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.614443064 CEST	192.168.2.6	1.1.1.1	0xa8b4	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.629722118 CEST	192.168.2.6	1.1.1.1	0xe243	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.645723104 CEST	192.168.2.6	1.1.1.1	0xeed0	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:27.274912119 CEST	192.168.2.6	1.1.1.1	0xe75a	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 00:53:25.532830000 CEST	1.1.1.1	192.168.2.6	0x5a9a	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.546880007 CEST	1.1.1.1	192.168.2.6	0x8f03	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.561333895 CEST	1.1.1.1	192.168.2.6	0xcc10	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.577673912 CEST	1.1.1.1	192.168.2.6	0x285f	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.591475010 CEST	1.1.1.1	192.168.2.6	0xa110	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.611376047 CEST	1.1.1.1	192.168.2.6	0x6924	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.626760960 CEST	1.1.1.1	192.168.2.6	0xa8b4	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.640600920 CEST	1.1.1.1	192.168.2.6	0xe243	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:25.656007051 CEST	1.1.1.1	192.168.2.6	0xeed0	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:53:27.308957100 CEST	1.1.1.1	192.168.2.6	0xe75a	Name error (3)	sergei-esenin.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.102.49.254	443	2012	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:53:26 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-25 22:53:27 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 25 Oct 2024 22:53:26 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=ad4cefdc44a24a83ed1f6f4c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-25 22:53:27 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-25 22:53:27 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-25 22:53:27 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-25 22:53:27 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Target ID:	0
Start time:	18:53:22
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6b0000
File size:	2'952'704 bytes
MD5 hash:	86087E9D4FB4889F84248663397C20E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	74.4%
Total number of Nodes:	39
Total number of Limit Nodes:	4

Executed Functions

Function 006BFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VY^_, xrefs: 006BFDFF
V, xrefs: 006BFEDC
J|BJ, xrefs: 006C000D
t, xrefs: 006BFCBE

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 035a641fbf15d12bd85642edffaaf2450d3f477e5717725f3799503c41e64e8f
Instruction ID: 80874ecae60596daef94f67ece46845e2e474d512fab6b5ea89ef26250f1b4be
Opcode Fuzzy Hash: 035a641fbf15d12bd85642edffaaf2450d3f477e5717725f3799503c41e64e8f
Instruction Fuzzy Hash: 27D168B45083809BD310DF548894BAFBBE6EB96744F18481CE4C58B362D335CD49DB96

Function 006BD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 006BD2F1

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 45e8fde01357f83d97b88bd75779ed3750a36783491477f62a223f3303178977
Instruction ID: 1194090ff86867b66f8bc58a9d172d0578eb64b9c8ecdd4c77dd3d7f7d22d1f4
Opcode Fuzzy Hash: 45e8fde01357f83d97b88bd75779ed3750a36783491477f62a223f3303178977
Instruction Fuzzy Hash: 8D415AB040D380ABD301BB68D685A6EFBF6EF52704F148C1CE5C49B212D336D8548B6B

Function 006F5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 006F5784

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 795176a8124412498c933735117ab6379d2b9ace51c5ff73020ee9219869b183
Instruction ID: 345e8c5375c201f218da6b5d0c97443ac097474405d8419285b3f7c7e9d3f25b
Opcode Fuzzy Hash: 795176a8124412498c933735117ab6379d2b9ace51c5ff73020ee9219869b183
Instruction Fuzzy Hash: 5411A37151C640EBD301AF18E841A2BBBF6DF86710F05882CE6C59B311D739D915CB97

Function 006F5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(006F973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 006F5BDE

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 006F695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 006F69C5

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 74f1872b72b72866069be6851a40c2189a5883a6371977683513fbda493cb3db
Instruction ID: 71c53d0c32659c535896f106a0116cdf6a58f7aa60781eae8a866ba6dfe90b4e
Opcode Fuzzy Hash: 74f1872b72b72866069be6851a40c2189a5883a6371977683513fbda493cb3db
Instruction Fuzzy Hash: 7631A5B05183059FD718EF28C8A063BB7E2EF84344F08991CF6C6972A1E7389904CB5A

Function 006C049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1229f333ede35c8e25dcbb02b13f85b1ee0379190f9d5bc23ea66313b09c54
Instruction ID: d35468c5758c2fe5d815547017439541a41e0a20d2dc25dd32c6ecda3cdd02f9
Opcode Fuzzy Hash: 1b1229f333ede35c8e25dcbb02b13f85b1ee0379190f9d5bc23ea66313b09c54
Instruction Fuzzy Hash: 4B918B75200B00DFD724CF25E8A4B27B7F6FF89310B118A6CE9568BAA1DB35E815CB50

Function 006C0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba32ba0a2c0152faad9cf3e92fd0ad8eeef85811562bd427a63e03a2e668c55
Instruction ID: 20f787abca9be9d27327893b7b6b7e0139818bc03d3e683d01a9393a5d2ad3a9
Opcode Fuzzy Hash: 7ba32ba0a2c0152faad9cf3e92fd0ad8eeef85811562bd427a63e03a2e668c55
Instruction Fuzzy Hash: 78716874200701DFE7248F21E8A4F26B7F6FF89315F10896DE9968B662CB35E815CB64

Function 006F99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f0336d5b069fd09ce1c3ea1ec5a69cfb87cccbb35be9ecefb1b6b743ae6bfe
Instruction ID: c6fb98ab8d94c742943e55d248ff2ba7561839812c3d5185ed5dfba8c3f01662
Opcode Fuzzy Hash: 82f0336d5b069fd09ce1c3ea1ec5a69cfb87cccbb35be9ecefb1b6b743ae6bfe
Instruction Fuzzy Hash: A241AC34208308ABDB149A19E890B3BB7A6EB85710F14982CE68A97351D335EC11DF66

Function 006F63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 135cd5f8c1aad47ec1436b84e6f7f68cb3809e8bf2700de5d3bd6478ef60dbc6
Instruction ID: 477a801568336966ab2e51e4941275f62b657cc03e7fe7a56acc55b0d8dc0a60
Opcode Fuzzy Hash: 135cd5f8c1aad47ec1436b84e6f7f68cb3809e8bf2700de5d3bd6478ef60dbc6
Instruction Fuzzy Hash: 1131EE70249305BADA24EA04CD82F3AB7E6EB80B10F649A1CF2815A2E1D770AC119B56

Function 006C0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a883810d27affd22d67f5c3888945bb1941678195fc9c94b476846025f7f9cb9
Instruction ID: f5d0d6890a2001bfa5c988237040cf1209b78e021921805f742910bed473594e
Opcode Fuzzy Hash: a883810d27affd22d67f5c3888945bb1941678195fc9c94b476846025f7f9cb9
Instruction Fuzzy Hash: 4B21E9B490021ADFEB15CF94CC90FBEBBB2FB4A304F144859E911BB291C735A951CB64

Function 006F3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 006F32A6

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3e613ad0b25dbf5413fe25062d7dda8703a8ee815f204dbd5e25bdadfb106b47
Instruction ID: 565c491b80ec256842dae53b3f6d1336520e3509ca88cc20a46204c566b09269
Opcode Fuzzy Hash: 3e613ad0b25dbf5413fe25062d7dda8703a8ee815f204dbd5e25bdadfb106b47
Instruction Fuzzy Hash: 97016D3450D350DBC701EF18E885A2ABBE9EF4A700F05891CE6C58B361D739DD60CB96

Function 006F3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 006F3208

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a128fc1a2456ba0abfd8bf6acc5dfe62d1002dbfd1e763fa561a9f3a7f43ac4b
Instruction ID: a3dbdecf9d8b4317d42f343dad94a2db2857dafd38a28422bf34694cb622bb39
Opcode Fuzzy Hash: a128fc1a2456ba0abfd8bf6acc5dfe62d1002dbfd1e763fa561a9f3a7f43ac4b
Instruction Fuzzy Hash: 00B012300401009FDA141B00EC0AF003510EB00705F801150B100040B1D5A55C64C559

Non-executed Functions

Function 006E23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

{l`~, xrefs: 006E268C
f@~!, xrefs: 006E25FF
mlc@, xrefs: 006E275C
Cx, xrefs: 006E453D
%*+(, xrefs: 006E40EF
ggxz, xrefs: 006E2685
3<, xrefs: 006E32D6
`tii, xrefs: 006E2693
fedc, xrefs: 006E2782
aenQ, xrefs: 006E276A
#v, xrefs: 006E344B, 006E4861
|}&C, xrefs: 006E2F21
:, xrefs: 006E32DD

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 800bdbf35b26a458c18e0a4347a47676661c078f123b1fb96c8d2b999247863c
Instruction ID: 69ebcef3678de8d5dfc28dd93fa501518bd0c5ad6f2b76b503e3462c6b688f4d
Opcode Fuzzy Hash: 800bdbf35b26a458c18e0a4347a47676661c078f123b1fb96c8d2b999247863c
Instruction Fuzzy Hash: 3F33DD70506B81CFD7258F3AC590762BBE2BF16304F58899DE4DA8B782C735E906CB61

Function 006CDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

D, xrefs: 006CE846
tsrq, xrefs: 006CE6FC
<=:;, xrefs: 006CE930
`Y^_, xrefs: 006CE99E
:WUE, xrefs: 006CF6B7, 006CF6C6
xgfe, xrefs: 006CE71D
89>?, xrefs: 006CE9F6
WP, xrefs: 006CDCEF
lkji, xrefs: 006CE73E
<=2, xrefs: 006CEA01
T, xrefs: 006CF157
%*+(, xrefs: 006CDE37, 006CDE46
LKJI, xrefs: 006CE6E6
tuJK, xrefs: 006CE967
QNOL, xrefs: 006CE775
AR, xrefs: 006CDD10
@ONM, xrefs: 006CE6DB
`onm, xrefs: 006CE733
()./, xrefs: 006CE9CA
89&', xrefs: 006CE93B
DCBA, xrefs: 006CE887, 006CE896
dcba, xrefs: 006CE728
mjkh, xrefs: 006CE7D8
|, xrefs: 006CECB1

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: f8cb82219372047218462a1bd7c57191fb8a102acacf7c14544afa69aec9a52b
Instruction ID: ae42aeb77cad71b95feb60bcc68163b122584659f52e359c0483eadddb39a47d
Opcode Fuzzy Hash: f8cb82219372047218462a1bd7c57191fb8a102acacf7c14544afa69aec9a52b
Instruction Fuzzy Hash: 4DF276B05093819BD770CF14C894BABBBE6FFD5304F54482DE4C98B292DB369985CB92

Function 006D9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

S], xrefs: 006DA636
?m,o, xrefs: 006DA13C
JG, xrefs: 006DAA27
Gt, xrefs: 006D9FF8
kW, xrefs: 006DA380
WQ, xrefs: 006DA62B
sm, xrefs: 006DA830
N[, xrefs: 006DA375
=], xrefs: 006DA36A
(a*c, xrefs: 006DA147
]{, xrefs: 006DA1E7, 006DA1F3
_Y, xrefs: 006DA641
CG, xrefs: 006DAA32
/), xrefs: 006DA66D
WH, xrefs: 006DAA1C
hi, xrefs: 006DAB9D
%e6g, xrefs: 006DA152

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 74d8134ee903de6977e33a3b174a96bfaab8ad79040576deb65bbaf2e65f2428
Instruction ID: 5e0eee1d283a612dd4b72a04de95c472af64ecea101809982a3bfe568e6cc7f4
Opcode Fuzzy Hash: 74d8134ee903de6977e33a3b174a96bfaab8ad79040576deb65bbaf2e65f2428
Instruction Fuzzy Hash: 4852C7B440D385CAE270CF65D581B8EBAF1BB92740F608A1EE1ED9B255DBB08045CF97

Function 006D9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

X/R), xrefs: 006D9AEB
pq, xrefs: 006D99E0
L3Y=, xrefs: 006D9B03
B?Q9, xrefs: 006D9B0B
;IJK, xrefs: 006D983E
T#a-, xrefs: 006D9AE3
,A&C, xrefs: 006D982E
!E4G, xrefs: 006D9836
8;, xrefs: 006D9B13
G'M!, xrefs: 006D9ADB
O+f), xrefs: 006D9634, 006D963D
2A"_, xrefs: 006D9980
G+X5, xrefs: 006D9AF3
B7U1, xrefs: 006D9AFB
z=Q?, xrefs: 006D9826
?M0K, xrefs: 006D9968

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: bbaba1a419798621eecfe979b6b932924a8fd9dd6bef8c123951857f0701a9f9
Instruction ID: 70a5a3d8bb2bdd1627d40008914ec9eb557e7c2fe56e0e67e8db4ee23fa7d458
Opcode Fuzzy Hash: bbaba1a419798621eecfe979b6b932924a8fd9dd6bef8c123951857f0701a9f9
Instruction Fuzzy Hash: A1F13EB0908381ABD310DF15D881A2BBBF6BB86B48F144E1DF4D59B352D374D904DBAA

Function 006DDD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

-M2O, xrefs: 006DE25A
hX]N, xrefs: 006DDDC7
<Y.[, xrefs: 006DE27D
,Q?S, xrefs: 006DE26F
m, xrefs: 006DE9C5
Y9N;, xrefs: 006DE245
)IgK, xrefs: 006DE261
upH}, xrefs: 006DDE8A, 006DE798, 006DDF4A
m, xrefs: 006DE403, 006DE664, 006DE7BD
=]+_, xrefs: 006DE276
rm, xrefs: 006DE92E
n\+H, xrefs: 006DDDC0
{E, xrefs: 006DE323
%*+(, xrefs: 006DE143

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: m$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$rm$upH}${E$m
API String ID: 0-4176905401
Opcode ID: 8260a3f67e0fc1eaffd6629a8bd4c09596a1b831abe4316dc7d12da384e88815
Instruction ID: 565be1face69b2588de66eb239b0ed31d82b7aa1ab50be1de7359dd216e977cb
Opcode Fuzzy Hash: 8260a3f67e0fc1eaffd6629a8bd4c09596a1b831abe4316dc7d12da384e88815
Instruction Fuzzy Hash: 0D92E471E00205CFDB14CF68D8916AEBBB2FF49320F29826DE456AB391D735AD41CB94

Function 0087D30C Relevance: 12.9, Strings: 9, Instructions: 1638COMMON

Download Yara Rule

Strings

HwXy, xrefs: 0087E332
z4O, xrefs: 0087D896
!m, xrefs: 0087DB6A
SN{, xrefs: 0087D79E
@, xrefs: 0087DC5B
:i}, xrefs: 0087E315
<w, xrefs: 0087DBE8
,7a], xrefs: 0087D9A9
Cj}}, xrefs: 0087DE77

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: ,7a]$:i}$Cj}}$HwXy$SN{$z4O$ @$!m$<w
API String ID: 0-259527830
Opcode ID: 17f5281c50c6d7af2aa9a55fa74a1a6910f469f02be2c4d6f9131b8f1232d98b
Instruction ID: 6af5e4c54482f6831ddf87c2a3bdf9e222fd1ab69291e010f94117e0afd68213
Opcode Fuzzy Hash: 17f5281c50c6d7af2aa9a55fa74a1a6910f469f02be2c4d6f9131b8f1232d98b
Instruction Fuzzy Hash: E7B2F8F360C2049FE304AF29EC8567AF7E9EF94720F1A892DE6C4C7344E67598418697

Function 006D098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

{, xrefs: 006D1502
cah`, xrefs: 006D107E
qrqp, xrefs: 006D1089
&> &, xrefs: 006D0F89
,#15, xrefs: 006D0F94
9.5^, xrefs: 006D0F9F
%*+(, xrefs: 006D0A77, 006D0A86
gce/, xrefs: 006D1073

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 0990c0a378eaec402aab3ac1f0197a993035663c57765e15dfcd7d974380a550
Instruction ID: 734b7d3f89d3124c3a6542844e4ff92db1318e9d2275e1cb7b4323f923b82ef5
Opcode Fuzzy Hash: 0990c0a378eaec402aab3ac1f0197a993035663c57765e15dfcd7d974380a550
Instruction Fuzzy Hash: 44628AB59083818BD730CF14D891BABB7E2FF96314F08492EE49A8B741D7759940CB93

Function 006B1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 006B157D, 006B15EB
@, xrefs: 006B2C40
gfff, xrefs: 006B2226
gfff, xrefs: 006B22E1
0123456789abcdefxp, xrefs: 006B1587, 006B15F8
-, xrefs: 006B21ED
gfff, xrefs: 006B2297

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 3189a74ed3245d1dff455b0d2a49bfa69fcd41c9baafa9b548e7f88c1249bd09
Instruction ID: 6e6c3195a068594af5f571c9219271b1ceaf0e200f25b654df95e198b6206c3e
Opcode Fuzzy Hash: 3189a74ed3245d1dff455b0d2a49bfa69fcd41c9baafa9b548e7f88c1249bd09
Instruction Fuzzy Hash: ACD206B16083529FC718CE28C4A43EABBE3AFD5314F18862DE595CB391D734D985CB82

Function 00879EED Relevance: 10.3, Strings: 7, Instructions: 1562COMMON

Download Yara Rule

Strings

`^w, xrefs: 00879FE5
3}o, xrefs: 0087B13A
"Nl{, xrefs: 0087A914
Cvo, xrefs: 0087B1BD
@Kb, xrefs: 0087A224
h w, xrefs: 0087AFA5
_mrS, xrefs: 0087A9C5

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: "Nl{$3}o$@Kb$_mrS$`^w$h w$Cvo
API String ID: 0-3264488947
Opcode ID: 8735ab64b7a9f75f2d13007393f49aa7ea02b8955790eb1b393dc84238e12c21
Instruction ID: 98a84a6df24c105db301f44977ba54561db2c24a089a5eb2f2d6055bd7c84e1a
Opcode Fuzzy Hash: 8735ab64b7a9f75f2d13007393f49aa7ea02b8955790eb1b393dc84238e12c21
Instruction Fuzzy Hash: 4FB2E5F350C204AFE3046E29EC8567AFBE9EF94720F1A493DEAC4C7744EA3558448697

Function 0088C3B4 Relevance: 9.1, Strings: 6, Instructions: 1588COMMON

Download Yara Rule

Strings

7N7S, xrefs: 0088C632
n, xrefs: 0088D193
$y, xrefs: 0088D149
vxkG, xrefs: 0088C627
pR}>, xrefs: 0088CE4F
p-k, xrefs: 0088CE59

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: $y$7N7S$p-k$pR}>$vxkG$n
API String ID: 0-2946278073
Opcode ID: f61c9c5d10d3a931b7b2f4a2854bc0fc8a7081eed848cd587d8835c0145cfbe9
Instruction ID: 0d4222bd0304174bf99f5d9cd9da82110a6690d10b2cff62f4e48fd13aea2b04
Opcode Fuzzy Hash: f61c9c5d10d3a931b7b2f4a2854bc0fc8a7081eed848cd587d8835c0145cfbe9
Instruction Fuzzy Hash: CDB239F36086049FE3046E29EC8567AFBE5EFD4320F1A8A3DE6C4C7744EA3558058697

Function 008784DB Relevance: 9.1, Strings: 6, Instructions: 1568COMMON

Download Yara Rule

Strings

wo%, xrefs: 00878607
4INn, xrefs: 0087875D
U, xrefs: 0087928A
cb">, xrefs: 008785C5
U9Q, xrefs: 00878B4E
ohh}, xrefs: 00879572

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 4INn$U9Q$cb">$ohh}$wo%$U
API String ID: 0-3177058115
Opcode ID: 006f7f46bd35fd4fab5c7fe0f8d0261d537fe5aaa02540f3fe5e493bca7fdd25
Instruction ID: 53839a2eb9d1b7790b02e0e16a6bd5fc6e362a145d78d15aaa917e4b61b01107
Opcode Fuzzy Hash: 006f7f46bd35fd4fab5c7fe0f8d0261d537fe5aaa02540f3fe5e493bca7fdd25
Instruction Fuzzy Hash: 33B2F8F3A082009FE704AE2DDD8567ABBE5EFD4720F1A893DE6C4C7744E63598058693

Function 006B12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 006B1DC1
i, xrefs: 006B28EA
0, xrefs: 006B243E
0, xrefs: 006B1E88
@, xrefs: 006B3531

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 567fbb59a7eb46c51d5c5a167269c5e91f121afc6d906da1fe789786d9616fb2
Instruction ID: 9a7072d48ccfcc8f286aab30cabcf48fe5465c39fbeab67d57d9893621d6a998
Opcode Fuzzy Hash: 567fbb59a7eb46c51d5c5a167269c5e91f121afc6d906da1fe789786d9616fb2
Instruction Fuzzy Hash: 5262C5B160C3829BD319DF28C4A07EABBE2AFD5304F18895DE4D987391D774D989CB42

Function 006B164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 006B1573
gfff, xrefs: 006B1F57
0123456789ABCDEFXP, xrefs: 006B164F
0123456789abcdefxp, xrefs: 006B1659
gfff, xrefs: 006B1F3C

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 1445c2ea5975f7b7927a57f0dde9d05d4db65ae00ddd74869895d9744ccaf710
Instruction ID: f0a03d4dc17e1d4b78e966c7cbdca69027fbf3d8bd82844579110b653fd28760
Opcode Fuzzy Hash: 1445c2ea5975f7b7927a57f0dde9d05d4db65ae00ddd74869895d9744ccaf710
Instruction Fuzzy Hash: 95F1D47160C3828FC715CE29C4942AAFFE2AFD9304F188A6DE4D98B352D734D985C792

Function 006B13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 006B1F57
0123456789ABCDEFXP, xrefs: 006B13A3
-, xrefs: 006B1F23
0123456789abcdefxp, xrefs: 006B13AD
gfff, xrefs: 006B1F3C

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 730d1bdbe8fc208a600406eb0874d1c53792d1b9ebc207e47a1aef92107677af
Instruction ID: 2f7053bfc027afa1b0d2e8a956888da07763b33d4fd40c4039ecbed8daf77689
Opcode Fuzzy Hash: 730d1bdbe8fc208a600406eb0874d1c53792d1b9ebc207e47a1aef92107677af
Instruction Fuzzy Hash: 94D1917160C7828FC715CE29C4942AAFFE2AFD9304F08CA6DE4D987356D634D989CB52

Function 0087B8D7 Relevance: 6.6, Strings: 4, Instructions: 1597COMMON

Download Yara Rule

Strings

/4~', xrefs: 0087BD92
oy}k, xrefs: 0087BB19
p), xrefs: 0087C2B2
%7x, xrefs: 0087BDFF

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %7x$/4~'$oy}k$p)
API String ID: 0-3876582
Opcode ID: 38bace7a87051997753d4c2b2cf947610baabbf6e827d55d36b7ded09fd90714
Instruction ID: f5334388c003747d44db73ccf074106b522935865def72e77246d4fc25b2deb2
Opcode Fuzzy Hash: 38bace7a87051997753d4c2b2cf947610baabbf6e827d55d36b7ded09fd90714
Instruction Fuzzy Hash: E8B205F3A0C2009FE3046E29EC8567AFBE9EFD4720F16893DEAC493744E63558458697

Function 0088245F Relevance: 6.6, Strings: 4, Instructions: 1596COMMON

Download Yara Rule

Strings

1*}, xrefs: 00883343
AW5, xrefs: 00882BA9
cK2, xrefs: 00882AEE
1;z~, xrefs: 00882489

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 1*}$1;z~$AW5$cK2
API String ID: 0-3106419159
Opcode ID: 22475a9301545fb590a23f83ab7b9d00568c5dc6c36dd08e829009da7837360b
Instruction ID: 7579f4caf9752139a8eb5f652c6c3044173e2f6b061c5d5758084fc33eb2238d
Opcode Fuzzy Hash: 22475a9301545fb590a23f83ab7b9d00568c5dc6c36dd08e829009da7837360b
Instruction Fuzzy Hash: 43B2E4F3A0C6049FE3046E2DEC9567ABBE5EF94720F16492DEAC5C3740EA3598048797

Function 00876FE7 Relevance: 6.1, Strings: 4, Instructions: 1134COMMON

Download Yara Rule

Strings

g|[., xrefs: 0087751E
jvt, xrefs: 0087713A
bqo, xrefs: 008771BE
ewg, xrefs: 00877435

Memory Dump Source

Source File: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: jvt$bqo$ewg$g|[.
API String ID: 0-2332930137
Opcode ID: 50d635778af6b805f66bab68927d57220fae5b92ed5fa1969aad8472c75c94a5
Instruction ID: d8a396ecb789bee974b1ac033d5f172b7d9b6806ea06585d6ce38c49965e0adf
Opcode Fuzzy Hash: 50d635778af6b805f66bab68927d57220fae5b92ed5fa1969aad8472c75c94a5
Instruction Fuzzy Hash: 017217F3A086049FE7046E2DEC8567AFBE5EF94720F1A493DEAC4C3744E53558058693

Function 00889456 Relevance: 6.1, Strings: 4, Instructions: 1130COMMON

Download Yara Rule

Strings

&m|', xrefs: 008896A5
PQCn, xrefs: 00889AD3
;v!, xrefs: 0088984C
$3, xrefs: 0088A1A2

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: &m|'$;v!$PQCn$$3
API String ID: 0-2676927048
Opcode ID: 9d697c98001a96b3bb6bb97f680a70ca83bc575e1ea41bb7204c8d5317a54442
Instruction ID: b29af60e2cb9d982edc06a79f674f1f120894bbd06f72317d56c2f9739b33a4d
Opcode Fuzzy Hash: 9d697c98001a96b3bb6bb97f680a70ca83bc575e1ea41bb7204c8d5317a54442
Instruction Fuzzy Hash: DE72E5F36082049FE304AE2DEC8577ABBE5EF94720F1A493DEAC4C7744E63598058697

Function 00887E29 Relevance: 5.7, Strings: 4, Instructions: 739COMMON

Download Yara Rule

Strings

b,Hx, xrefs: 00887EA1
G k{, xrefs: 00888696
UHN>, xrefs: 00887E69
}?m, xrefs: 00888660

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: G k{$UHN>$b,Hx$}?m
API String ID: 0-1691630294
Opcode ID: 517fe9bb8c79457dcf1ddcc130523ff4006d06d974fda617f8e17993259e7866
Instruction ID: ba602f21e8ef3c041ef6a77f5d604a4992efc82d2930af38516026163283bbbf
Opcode Fuzzy Hash: 517fe9bb8c79457dcf1ddcc130523ff4006d06d974fda617f8e17993259e7866
Instruction Fuzzy Hash: 9A3204F3A082149FD3146F2DEC8567ABBE9EF94320F1A493DEAC4C3344E63598548697

Function 006DFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

:, xrefs: 006E0087
uvw, xrefs: 006DFE95
NA_I, xrefs: 006E036D
m1s3, xrefs: 006DFEC3, 006DFECB

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 7051f2fd07e9f70fa932a0408b4bf44ce680a65466a2010a655e7c5f9249dd09
Instruction ID: 3a53069d488a2cf9751d6913e71c55cbc6923bf78276302ca1a56161b0187307
Opcode Fuzzy Hash: 7051f2fd07e9f70fa932a0408b4bf44ce680a65466a2010a655e7c5f9249dd09
Instruction Fuzzy Hash: 0732DAB0509381DFE300DF29D880A6BBBE6AB89300F548A6CF5D18B392D779D945CF56

Function 006C3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

;z, xrefs: 006C3C87
p, xrefs: 006C3C80
ss, xrefs: 006C3C79
%*+(, xrefs: 006C3EC4

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 3bdca4269bc3a3d94b8385049b97678b0f42fbd56f86196487275a5670cf0f4f
Instruction ID: e8695f9cadcfd1bb17fa8eaa2a07df4da3aec0f2708f768909e45d948289c541
Opcode Fuzzy Hash: 3bdca4269bc3a3d94b8385049b97678b0f42fbd56f86196487275a5670cf0f4f
Instruction Fuzzy Hash: 06024CB4810B00DFD760DF28D986B66BFF5FB05300F50895DE89A8B755E730A415CBA6

Function 006D2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 006D2317
lc, xrefs: 006D2507
sj, xrefs: 006D2327
hu, xrefs: 006D232F

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: ffa709b1e5c15b882cd71ab72fc29470aecef36ed59a8497916571c0366d43d0
Instruction ID: 905474743c1891f4bea7c8eb87e403673e8d91d2b3e64c74cd52a619672f7c0a
Opcode Fuzzy Hash: ffa709b1e5c15b882cd71ab72fc29470aecef36ed59a8497916571c0366d43d0
Instruction Fuzzy Hash: B2A19CB08083428BC720DF18C8A1A6BB7F1FFA5754F548A0DE8D59B391E339D941CB96

Function 006DD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

KV, xrefs: 006DD97D
#', xrefs: 006DD9EA
CV, xrefs: 006DD98B
T>, xrefs: 006DD984

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 303fd0eda78abcda5e89bb0dc2ba5e2f21497a54ec17776c58b82242a43bd83b
Instruction ID: 498be689373b43714ad155f69d2528c22a2147b7c4bec0b550abb24d18fc18fa
Opcode Fuzzy Hash: 303fd0eda78abcda5e89bb0dc2ba5e2f21497a54ec17776c58b82242a43bd83b
Instruction Fuzzy Hash: 288167B48017459BDB20EFA6D28516EBFB2FF12300F60460DE4866BB55C330AA55CFE6

Function 006DAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

,{*y, xrefs: 006DAD07, 006DAD13
(g6e, xrefs: 006DACA1
lk, xrefs: 006DACBC
4c2a, xrefs: 006DACA9

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 598bf7ffd85b316adcb36b3d5ce17f959ba5380cf620846b4c0c91f6d4abd07b
Instruction ID: 5ee8b612946b765c1fa608771c127c6c3d554371d34c5bcd1dab250332bbb1eb
Opcode Fuzzy Hash: 598bf7ffd85b316adcb36b3d5ce17f959ba5380cf620846b4c0c91f6d4abd07b
Instruction Fuzzy Hash: CD4165B4808382CBD7209F20D900BABB7F5FF86305F54995EE5C897260DB75D944CB9A

Function 006DC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

~/i!, xrefs: 006DC537
%*+(, xrefs: 006DC9E4, 006DC9ED
%*+(, xrefs: 006DC8C3, 006DC8CB

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 587809d36491ea576a961241eff930f37c44d991aac0adc10ced0535c395be41
Instruction ID: 7ab3360887abc7a6fbf949ea2bbab824cdcf0de3342def8bdfc8a30e12f0e779
Opcode Fuzzy Hash: 587809d36491ea576a961241eff930f37c44d991aac0adc10ced0535c395be41
Instruction Fuzzy Hash: 7CE198B1918345DFE3209F24D881B6BBBE6FB85350F48892DF6898B351DB35D810CB56

Function 0087EDAB Relevance: 4.2, Strings: 2, Instructions: 1656COMMON

Download Yara Rule

Strings

sZ}w, xrefs: 0087F174
5`?], xrefs: 00880149

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 5`?]$sZ}w
API String ID: 0-3295621614
Opcode ID: 2a1617d3b66462d3572822f096c6a32ddf6f24f89aead7ff7db97ad2e4af5e5c
Instruction ID: a7482b957567978dd419bfc93fd4dcf9041d31f2b344b0ca186cb3bb4b6dd675
Opcode Fuzzy Hash: 2a1617d3b66462d3572822f096c6a32ddf6f24f89aead7ff7db97ad2e4af5e5c
Instruction Fuzzy Hash: E5B217F360C2049FE308AE29EC8567AF7E9EF94320F16493DEAC5C7744EA7558018697

Function 006B8590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 006B8616
IEND, xrefs: 006B89F0
), xrefs: 006B860C

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 594706c21b23d35b24985c9d8e6ece6e61a47b9e4ebdc6703baea7b4a11a1aa3
Instruction ID: 906b18671097dbdbea7e324a7544b0e487b07d6e023ad31e3794fa6f9f78546c
Opcode Fuzzy Hash: 594706c21b23d35b24985c9d8e6ece6e61a47b9e4ebdc6703baea7b4a11a1aa3
Instruction Fuzzy Hash: 6BE1F3B1A083019FE310CF28C8817AABBE6BF94314F14492DF59597381DB75E955CBC2

Function 0088A8E1 Relevance: 4.1, Strings: 2, Instructions: 1594COMMON

Download Yara Rule

Strings

2/u, xrefs: 0088B2E4
NlN, xrefs: 0088AC4E

Memory Dump Source

Source File: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 2/u$NlN
API String ID: 0-1177345402
Opcode ID: 3373be4c04a0cff6dffd56e539bb96fc9d279733132cdfd26664d89d4993205f
Instruction ID: 1e292bdf36c199c77824bc12bbe49ff2882b825d252b39cf9176922240b2ab7f
Opcode Fuzzy Hash: 3373be4c04a0cff6dffd56e539bb96fc9d279733132cdfd26664d89d4993205f
Instruction Fuzzy Hash: 1AB2E6F360C2049FE3047E29EC4567ABBE9EF94720F1A893DE6C4C7744EA3598418697

Function 006F4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 006F420C
%*+(, xrefs: 006F40A4, 006F40AD

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 49bb6413484e54db897796884b8dbc8d681c5a1f495936a39372bb6ae51eab5b
Instruction ID: ed84d45ef384fdddafffe4b2a4e857b07fa826e4f6290b51c19eff548974066c
Opcode Fuzzy Hash: 49bb6413484e54db897796884b8dbc8d681c5a1f495936a39372bb6ae51eab5b
Instruction Fuzzy Hash: 831298716083459FC714CF18C880B7BBBE2FB89314F188A2CF6959B791DB35E9458B92

Function 006EF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 006EF6E6
dg, xrefs: 006EF7F5

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 2eb0ff4fdb3c2db0beb9f5a7a2fac62470b2f8bfa1e101a5cc8771568f008317
Instruction ID: 770027d37a0b48435c951c62e99df378ae109257f9ecf088b7d3820c38bebbc6
Opcode Fuzzy Hash: 2eb0ff4fdb3c2db0beb9f5a7a2fac62470b2f8bfa1e101a5cc8771568f008317
Instruction Fuzzy Hash: 20F1A971618342EFE704CF25C895B6ABBF6FB85344F14992CF1858B2A2CB38D945CB16

Function 006B35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 006B360E
Inf, xrefs: 006B3607

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 2b9e838114760b99787dfa4991cb4292fa5d0a27b4c3f76da2590fc7199cb185
Instruction ID: 597c1d7c2a720692ce6f8ca2dac9dd3a8e8e7a8c5830d1cc12593ed902b74045
Opcode Fuzzy Hash: 2b9e838114760b99787dfa4991cb4292fa5d0a27b4c3f76da2590fc7199cb185
Instruction Fuzzy Hash: F2D1F7B1B083219BC704DF29C88069EB7E2EBC8750F24892DF99997390E771DD458B82

Function 006CFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 006D0197
Ye[g, xrefs: 006D00F6

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 46a570d015712a58e7697784f9e6aa831224416e51399cba65d89edb7f8923a5
Instruction ID: be6f090d1ad2f2e14729761e76d7eae12904765749ec6facf551ddb4de538640
Opcode Fuzzy Hash: 46a570d015712a58e7697784f9e6aa831224416e51399cba65d89edb7f8923a5
Instruction Fuzzy Hash: F751BFB1A083419BE331CF14C881BABB7E2FF96310F18891EE4998B751E3749940CB57

Function 006B5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 006B54C8

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: aed50b1ad1ad2029458a5c5c292c1535b3baacf0d4a3187f874b8ca4b679a628
Instruction ID: 9de24b343459ddcc8c3a5b36c4ce96289795cbfc61e2550d55fbe60efacb2bd8
Opcode Fuzzy Hash: aed50b1ad1ad2029458a5c5c292c1535b3baacf0d4a3187f874b8ca4b679a628
Instruction Fuzzy Hash: 7D22B1F6A08B428BE7258E18D9403E6BBE3AFE0304F19856DD85B4B351EB71DC85C742

Function 006E12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 006E15D1

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: f88ff08142ceae41772ed65ef3e9e35ba24b7c037c1f641df4f3e74c39776475
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 5CF13671A093814FC724CF26C4506ABBBE7AFC6350F18896DE89A8F382D634DD45D792

Function 006DAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006DB2D3, 006DB2DB

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 71df087428e00426d0839998ea448f15a95c9e2762e31ed2b1f85dd96fac3d4e
Instruction ID: ddb32d97c278703307f3e0f1f3397953d9261a53735a7af8f489d7e0ad904816
Opcode Fuzzy Hash: 71df087428e00426d0839998ea448f15a95c9e2762e31ed2b1f85dd96fac3d4e
Instruction Fuzzy Hash: 24E1B971908306CBC724DF28C8905AFB3E2FF98781F569A1DE4C587324E735A959DB82

Function 006C6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006C6EF3

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0a29cb2f87d2fa90fb9f196246e76fe7780fd458277b771b7bb96a1de48509a5
Instruction ID: f7bb2ecd7e7d5a571a98c9413150a7b61a28a30a026186cf75768b3cf194e43e
Opcode Fuzzy Hash: 0a29cb2f87d2fa90fb9f196246e76fe7780fd458277b771b7bb96a1de48509a5
Instruction Fuzzy Hash: 1FF19CB5A00A018FC7249F24D891A36B3F7FF48314B148A2DE597877A2EB31F955CB49

Function 006D7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006D8263, 006D826B

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 47e3ebbce4b8cb32bc41cb2730155185cd5018a7f279cc9bfd72971d269e425a
Instruction ID: ed9d0025c7e1354c7afb82315fad6044b6f6d69a3cae988e2a0d6dfad24eb7a5
Opcode Fuzzy Hash: 47e3ebbce4b8cb32bc41cb2730155185cd5018a7f279cc9bfd72971d269e425a
Instruction Fuzzy Hash: E2C1BAB1908201AFD720AB14CC86A6BB7F6EF95714F08881DF8C59B351E735ED05CBA6

Function 006D8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006D9233, 006D923B

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4d5b59acd64f0c01c27ca812f1cbd296e7545f1d44c616ff1b59705e88101a62
Instruction ID: 5078f52ca32c11e92130c87be01f0f2382aca5f236931a16562f37bbb7821919
Opcode Fuzzy Hash: 4d5b59acd64f0c01c27ca812f1cbd296e7545f1d44c616ff1b59705e88101a62
Instruction Fuzzy Hash: 55D1CF70A18302DFD704DF68DC90A6AB7E6FF89314F09896DE48687351DB38E950CBA5

Function 006C4487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BIl, xrefs: 006C485E

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: BIl
API String ID: 0-3923794307
Opcode ID: 506ecabd5fbad6c4c29a1242f17018e54c3cb63cbb07ad1337b9087bb557db1f
Instruction ID: dda6ee3fd476ceb222abeb21d5cb1270566da6905a1ac9dcbbb95475ee2b2f72
Opcode Fuzzy Hash: 506ecabd5fbad6c4c29a1242f17018e54c3cb63cbb07ad1337b9087bb557db1f
Instruction Fuzzy Hash: E7E1EEB5501B008FD365CF28D9A6BA7B7E2FF06704F04886DE4AAC7752EB35A814CB54

Function 006F7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 006F8167

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 3a100a540b38d40214550f21da7f142d55911b9cfb752c2717aac1ce2767d6f3
Instruction ID: 27c8b72f9d8c5cabe1a819016882a6a7ca0c46854c38d5ae566d74f19d2e6a63
Opcode Fuzzy Hash: 3a100a540b38d40214550f21da7f142d55911b9cfb752c2717aac1ce2767d6f3
Instruction Fuzzy Hash: 10D108329082698FC725CE18D89076FB7E2EB85718F15866CEAB56B390CB75DC06C7C1

Function 006F6CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"po, xrefs: 006F7015

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: "po
API String ID: 0-918179491
Opcode ID: 3efb5dd98f851063d578950c430093bd9fc985779d3a3fdfc99b1f6af2592e36
Instruction ID: 0be6888c56ef498462a5844e757fa1e85482f5cebb6aa56965b94fea63a20a1e
Opcode Fuzzy Hash: 3efb5dd98f851063d578950c430093bd9fc985779d3a3fdfc99b1f6af2592e36
Instruction Fuzzy Hash: E3D1EF36618355CFC714CF38D88052BB7E6AB8A314F098A6DE991C73A1DB38DA44CB95

Function 006DCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006DCDC3, 006DCDCB

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 106f261c7d026052f73fd658bb295b58c9f797a83b8045dbffd113b37674adc4
Instruction ID: 47b73e73d1290b23bcdc1eb70d7aa270f2206d04999c5d8a764dfe0802907013
Opcode Fuzzy Hash: 106f261c7d026052f73fd658bb295b58c9f797a83b8045dbffd113b37674adc4
Instruction Fuzzy Hash: 4EB101B090830A8BD714EF18D880B6BBBE3EF85360F14492EE5C58B351E735E855CB96

Function 006BA850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 006BA9C3

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: cad9ded97b7e82cc4a0019f3266eb92a4e6443f4b469cb2101ed27b6a3359815
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 21B138701083819FC320DF58C88065BBBE1AFA9704F448A2DF5D997342D631EA48CB57

Function 006EFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006EFCA4, 006EFCAD

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f90b60b376643ac36776ee1d081c6801f384c408efe3acb95d7f5375e6427c69
Instruction ID: ce8a5f7748f58a98b2c0999da73dae0eee90cce21c08e694a7cabc8d3a3b13f2
Opcode Fuzzy Hash: f90b60b376643ac36776ee1d081c6801f384c408efe3acb95d7f5375e6427c69
Instruction Fuzzy Hash: BD81FD71119345EBD710DF19DC84B2BBBE6FB89740F10882CF28487292DB35E815CB66

Function 006CD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006CD663, 006CD66B

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 9ab2c82f235e2fb6dc12b1789171593539ddb3b8921c3e71f216a73402189591
Instruction ID: 5e4c20532b9cd954bc0d8ffaaf023fbe97d98f728a39e4747d7f84ab62bbf93f
Opcode Fuzzy Hash: 9ab2c82f235e2fb6dc12b1789171593539ddb3b8921c3e71f216a73402189591
Instruction Fuzzy Hash: BD61D0B1908204DBD710AF18DC82B7AB3B2FF94354F48492DF9859B391E735E911CB96

Function 006F4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006F4C33, 006F4C3B

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 66454c6c5fbae7947bc8df99431f1bb0d2ae3b6e67df3c38b30d3bc05f5e2aea
Instruction ID: 2e9c81b049c0520e8f7cc94564f0e9e25fe7b9694e96ecbdc4b5826ef4bb2e94
Opcode Fuzzy Hash: 66454c6c5fbae7947bc8df99431f1bb0d2ae3b6e67df3c38b30d3bc05f5e2aea
Instruction Fuzzy Hash: 6161DC716083099BD710DF29C880B3BBBE7EB84310F18895CEA8587792DB31EC11CB56

Function 007B5403 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

b"&N, xrefs: 007B54F6

Memory Dump Source

Source File: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: b"&N
API String ID: 0-3642269097
Opcode ID: 0e5f505e5c1eec96aaa697525a6d6cfd07877d3ebb9217f793633208df37893e
Instruction ID: 618f0204becd9ef8cc2eeb3db80b2b92f0e2ebe87bcbd8b182d2c29825d9669f
Opcode Fuzzy Hash: 0e5f505e5c1eec96aaa697525a6d6cfd07877d3ebb9217f793633208df37893e
Instruction Fuzzy Hash: 9361E8F390C2049FF304AE29DD8577BB7D9EB94310F1A863DEAD9C3780E93959408686

Function 006BE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 006BE333

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 66ea764be4c69f046bb98cf1710e837dc17b885ceb0ac8f9de277278961243d7
Instruction ID: 4dfee58b863ab4fd0d499aa6c71504857e79267130670f99a26ddcb00d8f7dea
Opcode Fuzzy Hash: 66ea764be4c69f046bb98cf1710e837dc17b885ceb0ac8f9de277278961243d7
Instruction Fuzzy Hash: D9512663A59A904BD328993C4C552E97AC70FA3334B3DC769E9F1CB3E1D56688419390

Function 006F3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006F39E3, 006F39EB

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 55bbc579c0fdc3aa39136f9d1aa5aeac1b7e924f3c949626baf37ab3a753f75d
Instruction ID: 4b97eea61f2940aecfbb8ff467c9887ce8503056231e36a7f379e4ad28e762d1
Opcode Fuzzy Hash: 55bbc579c0fdc3aa39136f9d1aa5aeac1b7e924f3c949626baf37ab3a753f75d
Instruction Fuzzy Hash: 75519C30609258DBCB24DF1AD884A3ABBE6FB85744F18891CE6C687351D772DE10DB62

Function 006C1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 006C1C3E

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 9f211c040f131d96e8f2a26369bbcc576b2cdffad67ff0cdcb0df88fe05638cb
Instruction ID: 6f294995f488e9eba4bb77d9ef461cb99a99b7356fdf4b8f527a1e3c505111e2
Opcode Fuzzy Hash: 9f211c040f131d96e8f2a26369bbcc576b2cdffad67ff0cdcb0df88fe05638cb
Instruction Fuzzy Hash: D94140B40083809BC7149F24C894A6BBBF1FF86314F049A1CF9C69B291D73ADA15CB5A

Function 006EFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006F0033, 006F003B

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 289679f412bc8b4a05be359f5a08a0a441231c7e35a8c58b370c7353f9f3d2c7
Instruction ID: 53815bbfbeee9978765aa6997bcbc7fde7c5e1056cadb15604a9d3dcf0050526
Opcode Fuzzy Hash: 289679f412bc8b4a05be359f5a08a0a441231c7e35a8c58b370c7353f9f3d2c7
Instruction Fuzzy Hash: A531E5B1508309ABE710EA54DC81F3BB7EAEB85744F544828FA85D7253EA31DC14CB67

Function 0082F531 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

{ma`, xrefs: 0082F59E

Memory Dump Source

Source File: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: {ma`
API String ID: 0-3961625420
Opcode ID: 73fb33989b4eea5e985a7f9e7ca4f76b00aac506ee24f01215ec2cf31eb1cca5
Instruction ID: f49dd07cd8082ee3ac4335bf3e968579d8d40582345ffbda70417fb91a7f39b9
Opcode Fuzzy Hash: 73fb33989b4eea5e985a7f9e7ca4f76b00aac506ee24f01215ec2cf31eb1cca5
Instruction Fuzzy Hash: FE31CBF7B186004BF3081A3ADD9872A7A92E7D5320F2B453DDA89873C1EC7984064246

Function 006DE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 006DE6A2

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 193c86b8ab91117edfda1eeaff701917c0e74321b220b89218c708aefa1590c1
Instruction ID: 1904fc87706dd5d1a9e76f8739f9644631a71b695f897c5536e776b44beed697
Opcode Fuzzy Hash: 193c86b8ab91117edfda1eeaff701917c0e74321b220b89218c708aefa1590c1
Instruction Fuzzy Hash: 2E3126B5D00244CFCB60DF94E8805AFB7B6FB4A304F54456DE446AB301D336AE00CBA6

Function 006C6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 006C703B

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: adf2dff0c86ed143074938bddf932b46417f416c516e01565f6b8faacf4ab743
Instruction ID: a75e61ab1ad9479bac2e73d199b99906b01d297bbddc9182727b0e116af67de1
Opcode Fuzzy Hash: adf2dff0c86ed143074938bddf932b46417f416c516e01565f6b8faacf4ab743
Instruction Fuzzy Hash: 0A4111B5204B04DBD7248B65C995F27BBF2FB09705F14895CE68A9BAA1E731E8008F14

Function 006DE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 006DE6A2

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 7e4cdff7e89391422e669dd280001a66b4dc8d322efc4fed52215ac3c96fc185
Instruction ID: 4ba8dfbb4a352c8de2bbe34c986683f20f501203c5a433c6f8208f9e8b368dc3
Opcode Fuzzy Hash: 7e4cdff7e89391422e669dd280001a66b4dc8d322efc4fed52215ac3c96fc185
Instruction Fuzzy Hash: 0C21D1B1D00244CFC760DF95D8805AFBBB6FB4A704F54495DE446AB341C336AE41CBA5

Function 006F9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 006F9D30

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 12f9a2b50605fd6eb9cfe69476c6b04cbbf930332d29d24c59d79cd7783034a0
Instruction ID: 50b86403eefc3baa890730127b1aa7d8ec3c73a68b445c2e3dfe606cca6df6d0
Opcode Fuzzy Hash: 12f9a2b50605fd6eb9cfe69476c6b04cbbf930332d29d24c59d79cd7783034a0
Instruction Fuzzy Hash: 853167709083049BD310EF14D880A6BFBFAEF9A314F24992CE6C897251D335D904CBA6

Function 006C4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9dc7328ab93454144863a6075c40495ca97cc4961af8ad6a0ed0a6e3f9b64e9
Instruction ID: 58ec26bd7d6f0c118b570712c17813db321cb16a946004bb3d18253a91dcae85
Opcode Fuzzy Hash: f9dc7328ab93454144863a6075c40495ca97cc4961af8ad6a0ed0a6e3f9b64e9
Instruction Fuzzy Hash: 7E6254B0600B408FD725CF24C990B66B7F6EF4A700F58896DD49B8BA52E735F884CB95

Function 006BBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 5f4c43f6fab20ef95e2fed8c40389931f6404116aacdc86efc491a2079d705eb
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: D25208716087118BC7259F1CD4502FAB3E2FFC5329F294A2DD9C693381E735AA91CB86

Function 006F8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04094f42a0ce060fca002799ebae4271196a69802a6b48771b8ac5c4972bd8a
Instruction ID: 71cfd27bf81e065684f343778599042911946c64127bd4b72b7fb77344283f75
Opcode Fuzzy Hash: a04094f42a0ce060fca002799ebae4271196a69802a6b48771b8ac5c4972bd8a
Instruction Fuzzy Hash: CA22ED75608344CFC704EF68E89062AB7F2FF8A315F098A6DE68987351CB39D950CB46

Function 006F86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b89e9e70145578533c02b959a0333a0dde86cf05aabe787dae3f25c80d2684
Instruction ID: 50805dc0e18c6c4e2651d717bc6182df77f1e87a75a195aafa29a107df61279b
Opcode Fuzzy Hash: 61b89e9e70145578533c02b959a0333a0dde86cf05aabe787dae3f25c80d2684
Instruction Fuzzy Hash: D622AD75608344DFC704EF68E89062AB7F2FF8A305F098A6DE68987351CB35D950CB56

Function 006BB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1a571d64bb7eb47d7c9d0ac9c01880f93b0b5c058e6122a415385a8f3c164a
Instruction ID: a8edde30b362646e3e0a3440bf75ce9657f36fea9d4aaaeadc0974c29fdc9b34
Opcode Fuzzy Hash: fc1a571d64bb7eb47d7c9d0ac9c01880f93b0b5c058e6122a415385a8f3c164a
Instruction Fuzzy Hash: 295282B0908B848FE735CB24C4947E7BBE3AF91314F14686DC5E606B82C7B9A9C5C751

Function 006B71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a2e61a6914d3a92979bb68d21ec2aefb349ca7f68ee5c7abb4071b93a6b907
Instruction ID: 21e6caa64cff575a8d308e4462acee29c9820f06a39a067adf029f3eb54c6feb
Opcode Fuzzy Hash: c4a2e61a6914d3a92979bb68d21ec2aefb349ca7f68ee5c7abb4071b93a6b907
Instruction Fuzzy Hash: 3B52A2B150C3458FCB15CF29C0906EABBE2BFC8314F198A6DE89A5B351D774D989CB81

Function 006B8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897027574c7447e5710ad7d7c8d21e08b653a4224ab19bb3091c329ab424240b
Instruction ID: e07827a6807cfb5279f5ed00ea1fec6832d27c697745f942a0ed52611d7e0399
Opcode Fuzzy Hash: 897027574c7447e5710ad7d7c8d21e08b653a4224ab19bb3091c329ab424240b
Instruction Fuzzy Hash: B94288B5618301DFD708CF28D8547AABBE2BF88315F09886CE5858B3A1D736D985CF52

Function 006B7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91c77736bed96e792bf016390ca9d205c2cbf4c874c18436258fc7080f51d44
Instruction ID: 84ab3fc6897c08f1e78ce579ab24b277ce6786882adc34fa234d685b3f3fdcae
Opcode Fuzzy Hash: a91c77736bed96e792bf016390ca9d205c2cbf4c874c18436258fc7080f51d44
Instruction Fuzzy Hash: 443232B0514B118FC338CF29C5905AABBF6BF85700B604A2ED6A787B90D736F885CB14

Function 006F89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f3d857f81926a610253a712bbb7256e09ce789ad5c557496401df69e4da020
Instruction ID: 079d310840e121f0acdbe5e0a2ec9904a13b55f32145822c0d5ced53cfd9bc3f
Opcode Fuzzy Hash: d0f3d857f81926a610253a712bbb7256e09ce789ad5c557496401df69e4da020
Instruction Fuzzy Hash: 0A029B75608245DFC704EF68E88062AFBE2FF8A305F098A6DE6C587361C735D950CB96

Function 006F8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43705423ebf1bbab34bfd6ec27fe8e7118ea3174f489e1bcb16f6f78f896a043
Instruction ID: f6a77534eedd2e9676e78c73f011b45a6ca4fdb6184c9b52ab7c2c9b87e77884
Opcode Fuzzy Hash: 43705423ebf1bbab34bfd6ec27fe8e7118ea3174f489e1bcb16f6f78f896a043
Instruction Fuzzy Hash: AFF17975608344DFC704EF68D88062AFBE2BF8A305F098A6DE6C987351D736D910CB96

Function 006F8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611fb7ed0d220349f40548a725492e1c027a08ebdd3974970688127ef7a9b47f
Instruction ID: 2c24018cc397b53a9b168125001d88aea744f4484d353a7ae5162d8a49bb50ce
Opcode Fuzzy Hash: 611fb7ed0d220349f40548a725492e1c027a08ebdd3974970688127ef7a9b47f
Instruction Fuzzy Hash: D3E1AF71608341CFC704DF28D88062AF7E2FB8A315F098A6CE6D997351DB3AD910CB96

Function 006BA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: fc6aafe2f13b0f4368153d7f2774c8442f5b136ef0562c9b40fafa2d45af76f2
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 03F1BFB66083418FD724CF69C8816ABFBE6AFD8300F08882DE4D587751E635E985CB56

Function 006F8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c364f66bd2ec144754b0370bd0ea7ff2e83466effb4626e8d10a4bd587aac08
Instruction ID: 56890db9d2b980324dd1f0315189760344ff66bf678bf66c1acc2ca6021aa155
Opcode Fuzzy Hash: 5c364f66bd2ec144754b0370bd0ea7ff2e83466effb4626e8d10a4bd587aac08
Instruction Fuzzy Hash: E5D19C7460C244DFD704EF28D88062AFBE6FB8A305F098A6DE6C587351D736D910CB96

Function 006F7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6b94136b00c89fbc2f7ac3a897476a8120080f9a016fe8047d9c9e1e61b105
Instruction ID: 15b7c4dec4663dfd901e0f128d4feb5f4fab63d44cd5e787ad1ddc284a5a1f3a
Opcode Fuzzy Hash: 7a6b94136b00c89fbc2f7ac3a897476a8120080f9a016fe8047d9c9e1e61b105
Instruction Fuzzy Hash: D4B10372A083544FE324DE28CC41B7BB7E6AFC5314F08496DEA9997382EB35DC058792

Function 006BAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 06f45500bd9d8f4c405b5db2e31178aac8e82b19a5241eff101f46e909774e6d
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: A7C14AB2A187418FC360CF68DC96BABB7E1BF85318F08492DD1D9C6342E778A155CB46

Function 006C6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d65a666a1700c66ee680d07338394b65256751cbf1d6bd6dfad141840e0c54
Instruction ID: f5ea313feecc225f920e9e13709cabd91bf3e12c88436f21ad41b0ffa11d2882
Opcode Fuzzy Hash: 28d65a666a1700c66ee680d07338394b65256751cbf1d6bd6dfad141840e0c54
Instruction Fuzzy Hash: AAB104B4500B408FD3218F24C991B67BBF2EF46704F54885CE8AA8BB52E775F805CB69

Function 006F7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c00afd49b627353e363d4d5b239641681af4b5d00b3e730a4d3caaed80c8463e
Instruction ID: a789c0354b19d145ff31f313b57870e159be21b62e5dfc0cbe9d58a470d5666b
Opcode Fuzzy Hash: c00afd49b627353e363d4d5b239641681af4b5d00b3e730a4d3caaed80c8463e
Instruction Fuzzy Hash: 54919B7160C345ABE720DB14D880BBBBBE7EB85350F54882CFA9587351E730E940CB96

Function 006FA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21e11f99f79de64b29a1715a62f377abaed0f4060317278595330b75a89f646
Instruction ID: f15be826a4c8660c7da8a15e8a130ed13c722440839d239ed295170195f66a0d
Opcode Fuzzy Hash: d21e11f99f79de64b29a1715a62f377abaed0f4060317278595330b75a89f646
Instruction Fuzzy Hash: DE819E752083098BD724DFA8C890A7AB7F6EF49740F45892CEA89C7351E731ED10CB92

Function 006E64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86e77f27f7f74d32a0ab54696f1f1e6ed86c447049ab14fe39593e6a487065c
Instruction ID: b4c5d5ebf74ec58ddd1ff9d54fe32aab007e21f518e794a02591f1f776bc22c0
Opcode Fuzzy Hash: c86e77f27f7f74d32a0ab54696f1f1e6ed86c447049ab14fe39593e6a487065c
Instruction Fuzzy Hash: D771E733B2ABD04BC7149D7D8C463A5AA534BE6374B3DC379B9B48B3E5D5298C064341

Function 006D28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49859e5fc99c65c7bc6b926fdd66f8b41de6ff0e28ccb74995be34fb0339c37
Instruction ID: 96cdcd13ff3c14d0386333937d7a85de2e389b85824ac7aea5ae922072b4081f
Opcode Fuzzy Hash: f49859e5fc99c65c7bc6b926fdd66f8b41de6ff0e28ccb74995be34fb0339c37
Instruction Fuzzy Hash: B36169B48083419BD310AF14D851A6AB7F2FFA6764F04491DF4C59B361E33AD914CBA6

Function 006D7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5344d6cf38efa7fb626fa6db0e5e654e485ad2ae21a436aa39006ddb9df8a2a8
Instruction ID: 199ccac657afb48b0da5bcf006278939ec8e335e51474ca5d057e384aacd96f0
Opcode Fuzzy Hash: 5344d6cf38efa7fb626fa6db0e5e654e485ad2ae21a436aa39006ddb9df8a2a8
Instruction Fuzzy Hash: C451BDB1A18204AFDB209B24CC92BB773B6EF85368F144559F985CB391F375E901C762

Function 006E1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: f9384b8ca5f331b97ff62657d11a7202542e1ef5c0cd3520983602f0ebb67e9f
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: EA61D03160A3819BD714CE2EC58076FBBE3ABCA350F64C92DE4998F351D270DD86A741

Function 006E82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c2f10ba135dca90d731ab39a2d7aac8ad91ad7d50f2233789d9a9af8d626a7
Instruction ID: 076d012066c87b604fee0a9a728dcb1fcddd1b2c39dbb846e1a60ec02b83708d
Opcode Fuzzy Hash: 80c2f10ba135dca90d731ab39a2d7aac8ad91ad7d50f2233789d9a9af8d626a7
Instruction Fuzzy Hash: 44613623A5BBD18FC314453E5C563A6AA835BD2730F3EC36A98B98B3E5CD6948078341

Function 006C42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06760de29c75539ad03c85e12e2691f4e3b7e8e71b18f3e44c7c31b30a9ef615
Instruction ID: ef45c73dfa97e223f9e077125cf40dac8844ca90e0017edf2b4353565a16213d
Opcode Fuzzy Hash: 06760de29c75539ad03c85e12e2691f4e3b7e8e71b18f3e44c7c31b30a9ef615
Instruction Fuzzy Hash: 0981E1B4810B00AFD360EF39D947797BEF5AB06201F404A2DE4EA96695E7306459CBE3

Function 006EE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 0663ec97a482e41c0cdc3b5430870fb0622a79a52f50483b7f75eb97309341f4
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 01517DB16097548FE314DF69D49435BBBE1BBC5318F044E2DE4E987350E37ADA088B82

Function 006F7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d453418d5597fa5e968007d662737b6ac56600cbf2ca2835b254f1439a8fee06
Instruction ID: 9b76ba6cce77b65f44a89b9045831ab549d9bcf656e1bd13e4e1774cfcb3eb13
Opcode Fuzzy Hash: d453418d5597fa5e968007d662737b6ac56600cbf2ca2835b254f1439a8fee06
Instruction Fuzzy Hash: EF51093160C2049BC7159E18DC90B3EB7E7FB85754F288A2CE6D597391D732EC108B55

Function 006B5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca14c04b78efdf7f344090abe395892530ec93c98e8b9e3adc10c74088e6ad7
Instruction ID: d0953887b7c4a50d3befb84e6b1985ca8ec5f9086fc5bf7231352512fd36116f
Opcode Fuzzy Hash: aca14c04b78efdf7f344090abe395892530ec93c98e8b9e3adc10c74088e6ad7
Instruction Fuzzy Hash: 8351A4B59047049FC714DF14C890AEABBA2FF85324F15466CF89A9B352D731EC82CB95

Function 00976198 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262c614bef61efb3b06da4979ddca3237edbeff9ee68dde6baf67a16c4d298c2
Instruction ID: 4b3b12a88d50a1d377d31514be2713e5599161789c0007a09b9da192c2c1f2cd
Opcode Fuzzy Hash: 262c614bef61efb3b06da4979ddca3237edbeff9ee68dde6baf67a16c4d298c2
Instruction Fuzzy Hash: 604147B320CA04EFD349BE28DC4563AB7E9EB90310F35C93DE68B82745FA295404A656

Function 007A1FD8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1139fcc58b5897e9935117952532c5df37ed7a1abe70d7f58c9491a9db64d7
Instruction ID: b1fbf9cef02137552317e71ea65680d1eaf3206c1d801e66a37a6a227e09994d
Opcode Fuzzy Hash: fc1139fcc58b5897e9935117952532c5df37ed7a1abe70d7f58c9491a9db64d7
Instruction Fuzzy Hash: 1141B7B36082109FE314AE29DC9477ABBE5EF84320F168A3DDAD897784DD3948418696

Function 006DEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b0af364bbfedc3c18ed2053c27e69de317c1771b90ccad17cc2e100283598
Instruction ID: 8afdc8c354e97697d48e3fb3c6ef88d4995800fb2a97c3bc242742971935290d
Opcode Fuzzy Hash: 485b0af364bbfedc3c18ed2053c27e69de317c1771b90ccad17cc2e100283598
Instruction Fuzzy Hash: 8641AC78D10319DBDF209F94DC91BA9B7B2FF0A300F044549E945AB3A0EB39A950CBA5

Function 006F9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6860f329a3634644df93264ed02417cc8973a29b6c3d021c8f7498a24c6196d9
Instruction ID: 900592540db219fa5fafd297be099175ac3c4f17e9352c9fd129207f7a600012
Opcode Fuzzy Hash: 6860f329a3634644df93264ed02417cc8973a29b6c3d021c8f7498a24c6196d9
Instruction Fuzzy Hash: 2A418934608348ABDB109B14D990B3BBBE6EB85714F24882CF68A97351D335E801DBA6

Function 006C2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3670ec168f0d89bffb6e75dbb26eb88e73214672de87361bc4d4df24b0c322f8
Instruction ID: 6489ac077a66956eeb2043132edae2c449deac16fdbcc9ba8114cd03966c9102
Opcode Fuzzy Hash: 3670ec168f0d89bffb6e75dbb26eb88e73214672de87361bc4d4df24b0c322f8
Instruction Fuzzy Hash: ED41F772A083664FD35CCE2984A477ABBE2AFC4310F09866EE8D6873D4DA748945D781

Function 006C1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46755c554e7c0832a74eb3a017b8afdd3b7aa627066ced920a703b5867c2e579
Instruction ID: 8fd5041f327b026144ce8b03cbfda9e92772019d488ff370952b2aa072584704
Opcode Fuzzy Hash: 46755c554e7c0832a74eb3a017b8afdd3b7aa627066ced920a703b5867c2e579
Instruction Fuzzy Hash: F841E0745083809BD320AB59C884F2EFBF6FB87744F14491DF6C497292C376D8148B6A

Function 006F8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50995d82b8df7ea209abc20e3acae7bf87b135789683be5feec81376aeb8c1e
Instruction ID: 87ad9dc630a288572de076c81991349b92d8ca4ff8c92ee06b41447c3ce8e538
Opcode Fuzzy Hash: e50995d82b8df7ea209abc20e3acae7bf87b135789683be5feec81376aeb8c1e
Instruction Fuzzy Hash: A2419F3160C2548FC704DF68C49053EFBE6AF9A300F198A9DD5D997391DB75DD018B86

Function 006CD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992fef376c4885ac2a1a2cdaa3366ee5a0b056f60e2dd3dd632ac4c69839ad90
Instruction ID: 99454f22b4ff56a3f47fb290bb87fb615f96a5b2a6c6314da824f81c11023d23
Opcode Fuzzy Hash: 992fef376c4885ac2a1a2cdaa3366ee5a0b056f60e2dd3dd632ac4c69839ad90
Instruction Fuzzy Hash: 704179B55083818BD3309F14C881BABB7B2FF96360F04496DE48A8B792E7754941CB9B

Function 006EF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 56cd6e80f29120fe88e4ede376d2a4085676b5a6b64bd35b3706c6e6ffdcf600
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 142137329082644BC3249B1AC49157BF7E6EB99704F06867ED9C4A7295E3359C2087E1

Function 00924186 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3c13d2eac12094ed64c1b51fae608342534be2d61dfc9f949ee3029e248d97
Instruction ID: 04b7237ae972c1c8b99195b9c49ef4353c6668f57a9036c5bbd6c7a06fe24967
Opcode Fuzzy Hash: ef3c13d2eac12094ed64c1b51fae608342534be2d61dfc9f949ee3029e248d97
Instruction Fuzzy Hash: 953148B251C728CBD308BD79FD9137AB7D5E764310F224A3DDA9242B48E939184082C7

Function 006F67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19616f666fbf7534a9c810612d871f917916358dbea933aa3230ebb914da4e0
Instruction ID: dbec7bab3ac8c810dac03c880e977b2626601487591198d3b1447b758af14260
Opcode Fuzzy Hash: c19616f666fbf7534a9c810612d871f917916358dbea933aa3230ebb914da4e0
Instruction Fuzzy Hash: 2131347051C3829AD714CF14C49066FBBF1EF96788F50990CF4C8AB261D338D985CB9A

Function 006D5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300fe7cf0b4302b0eaa56e7f6f1f29e2e98055db4d36693825f6d91e1ba99115
Instruction ID: b0b23811198df9911491f82947f1e48d086b3f1701aba4d4db1eb6be3d5ae27a
Opcode Fuzzy Hash: 300fe7cf0b4302b0eaa56e7f6f1f29e2e98055db4d36693825f6d91e1ba99115
Instruction Fuzzy Hash: C121A1709083019BD310AF18C84196BB7F6EF92765F44890DF4D69B792E334DA00CBA7

Function 006B49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 314fb91a017674ba7d1e797c9257c327b9cfd4aa88afd08f5de4f46a051c5323
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: C531EAB16482009BD7149E19D8809EBB7E2EFC4358F18892CF89AD7346DA31DCC2CB46

Function 006F64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf17ebf5771fad9879e21ae22d906bf66c228a74c3e458186d9c51bd2ab145c
Instruction ID: 0660c00babcc2fc2fac279977c1389bb96cb48902720bcfbd27acf9943cc2b06
Opcode Fuzzy Hash: 2cf17ebf5771fad9879e21ae22d906bf66c228a74c3e458186d9c51bd2ab145c
Instruction Fuzzy Hash: 43215070608204EBC708EF19D980A2EFBE6EB95744F28981CE6C493361C739A851DF66

Function 006EB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b3820089e273cb9badf161151bbd914114b353347e367abb0134d0b803de463e
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: FD11E933A062E50EC7168D3D84405A6BFA31AA3234B6953D9F4B49B2D2D7228D8A8754

Function 006E0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 8d32400407b23e1c14b313fcc098a0c6bf29ff889ba046b7e27067c0fa5ea0c0
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: CF01B5F5A0234247F7209E5294D0B7BB2AABF80728F18452CE40657301DBB2EC85C7A5

Function 006DD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7f7a941fa90f25a46b488db1c20a90be78aff9d24f9981f3fe1083f5601d08
Instruction ID: 839430e00b24e0cc81282d4f8ee2ff0ea92a8bba2e573583657c47aad6c4d0f1
Opcode Fuzzy Hash: 0e7f7a941fa90f25a46b488db1c20a90be78aff9d24f9981f3fe1083f5601d08
Instruction Fuzzy Hash: F011ECB0418380EFD310AF618484A2FFBE5EBA6754F148C0DF6A49B251C779E819CF5A

Function 006B6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a8bbfac095ebf83a855facda363d038dfcd463ca2ddddf9cb370c6eff74e6f
Instruction ID: b20456c295798820b771f607422d9dbb807de1c82e3d894614468a514187425f
Opcode Fuzzy Hash: 78a8bbfac095ebf83a855facda363d038dfcd463ca2ddddf9cb370c6eff74e6f
Instruction Fuzzy Hash: 98F0243A71820A0BA210CDAAE8808BBB39BD7C9354B052538FA41C3301CD72E8028294

Function 006EB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 006CC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 006CB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: aafd8570c443ba0b4769c722336d78f97a85a11f2c678ebf687d78da467c4ff2
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 15F05CB160851017DF268A449CC1F77BBDDCB87314F09146EE84453207D2615848C3E9

Function 006E8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d105b3555cd991929279b2b81f7fd09ee7a8d96c3b84b9964c5083a332fc7a3
Instruction ID: e52a7e40b5c5115929e7bd733791b327c078079bd967619bd1b9c4b7d615157d
Opcode Fuzzy Hash: 5d105b3555cd991929279b2b81f7fd09ee7a8d96c3b84b9964c5083a332fc7a3
Instruction Fuzzy Hash: 4401E4B0410B009FC360EF29C545757BBE8EB08714F004A1DE8AECB680D770A544CF82

Function 00717743 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37a35091240384a3a7f7257f58ffd8e4e9df60e710d2855b625ffe1350519f6
Instruction ID: c1c38d3cbe34467f16362c034486dba7ae63e6e668db9a843a81e10f18b8257a
Opcode Fuzzy Hash: b37a35091240384a3a7f7257f58ffd8e4e9df60e710d2855b625ffe1350519f6
Instruction Fuzzy Hash: CDE0C2B216E3099ED70D9988DC25AF733BCD790A01F35001CA741032C0BCAD2D4AC29A

Function 006F1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: c0de738bb507e84d62a4465f6ffd563329a30c2cf813a485b262ab61ce90b22e
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 12D0A731608325869F748E1DA4009B7F7F1EAC7B51F49955EF686E7248D230DC41C2A9

Function 006C1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20127dc273c3fe8ffa5b2727828e96d9563699e9dd7f027aa98eaf74a984272d
Instruction ID: 8ddbe9768cba77d0522597b3c6751dd892f262db1f76afc79443d6ab2d38879e
Opcode Fuzzy Hash: 20127dc273c3fe8ffa5b2727828e96d9563699e9dd7f027aa98eaf74a984272d
Instruction Fuzzy Hash: A3C01234A180008BC304CF40A89AA32A2FAAB07208B00B02AEA02E7222CA20C402DA09

Function 006F6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249328de8a17bf0e57467c4be1df2de1dcc891a6b13ae0cb0fbf8d211ddbc324
Instruction ID: d347d68e5fd29b9dc2ab1a51ae1ed158395140ee407f188cb421b2e15cd34bdf
Opcode Fuzzy Hash: 249328de8a17bf0e57467c4be1df2de1dcc891a6b13ae0cb0fbf8d211ddbc324
Instruction Fuzzy Hash: 23C04878A6E004C6E208CE09A951975F6AB9A9BA18A24F25AC90623296C968D912991C

Function 006C1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706c5564922b85cdb3c40e5bc8d4686f578d3796d1ffb2a83f51ab79b5adbdfa
Instruction ID: 487d7310cac5b6e37e93abb2b8c91a9e59d97f631f6dd543780ef4ef25de77f8
Opcode Fuzzy Hash: 706c5564922b85cdb3c40e5bc8d4686f578d3796d1ffb2a83f51ab79b5adbdfa
Instruction Fuzzy Hash: 94C09B34A59040CBC344CFC5E8D2531A3FE9707208B10303E9B13FB263C560D405D60D

Function 006F5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184270749.00000000006B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000000.00000002.2184245974.00000000006B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184367849.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184387006.000000000071A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184425460.000000000071B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184456126.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184572508.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184588518.0000000000877000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184617611.000000000088D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184636175.000000000088F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184655515.000000000089B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184696097.000000000089E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185356273.000000000089F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185380156.00000000008A3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185397562.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185417791.00000000008AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185436192.00000000008B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185455046.00000000008B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185469451.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185489128.00000000008CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185510436.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185531399.00000000008DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185545536.00000000008E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185562686.00000000008F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185576295.00000000008F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185589532.00000000008F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185602392.00000000008FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185617208.0000000000902000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185629644.0000000000903000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185641114.0000000000904000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185659236.0000000000909000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185691942.0000000000916000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185708369.0000000000918000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185723894.0000000000920000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185737514.0000000000925000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185755612.000000000092C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185791302.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185803070.000000000092E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2185815980.0000000000974000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186492294.00000000009A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186522654.00000000009A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186557062.00000000009AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186607572.00000000009B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186619046.00000000009B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3693ddff98fb7dc575ce1b0270a256538fc0e97179aebfee0126e1d2d8fd63a0
Instruction ID: 6b3dc3cec8e99fa0a6f9a985eb9a73260e0ece9c34e03285cd8d055795ac3d0c
Opcode Fuzzy Hash: 3693ddff98fb7dc575ce1b0270a256538fc0e97179aebfee0126e1d2d8fd63a0
Instruction Fuzzy Hash: A5C09264B69000CBF24CCF19DD51A35F6BE9B8BA1CB14F22DC806A3256D978D512860C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 006BFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 006BD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 006F5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 006F5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 006F695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 006C049B Relevance: .3, Instructions: 264
COMMON

Function 006C0228 Relevance: .2, Instructions: 218
COMMON

Function 006F3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 006F3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON