Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ugslmd.exe

Overview

General Information

Sample name:ugslmd.exe
Analysis ID:1432144
MD5:551ed08a9076a98b16ce6dd72c993209
SHA1:7f6e01bbbfe0caa479cb9feee9cec092fd4fde9d
SHA256:b3507a576c4b7861f343a95f00e177c0aaeb44fac3400dd054fe8c0aeeeddccd
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to dynamically determine API calls
Detected potential crypto function
Entry point lies outside standard sections
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • ugslmd.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\ugslmd.exe" MD5: 551ED08A9076A98B16CE6DD72C993209)
    • conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: ugslmd.exeVirustotal: Detection: 18%Perma Link
Source: ugslmd.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\ugslmd.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004080640_2_00408064
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040807B0_2_0040807B
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004070390_2_00407039
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00407D5C0_2_00407D5C
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004089110_2_00408911
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00403D150_2_00403D15
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040891E0_2_0040891E
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00403D250_2_00403D25
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040652E0_2_0040652E
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004065390_2_00406539
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004051CC0_2_004051CC
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402D970_2_00402D97
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402DAE0_2_00402DAE
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004051B40_2_004051B4
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004056450_2_00405645
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004056010_2_00405601
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004072130_2_00407213
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040721E0_2_0040721E
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004042210_2_00404221
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004042340_2_00404234
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004092CB0_2_004092CB
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00409AA90_2_00409AA9
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004092BC0_2_004092BC
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00408F6C0_2_00408F6C
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00408F7A0_2_00408F7A
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040330A0_2_0040330A
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00409F0B0_2_00409F0B
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00409F1A0_2_00409F1A
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004047B30_2_004047B3
Source: ugslmd.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: mal48.winEXE@2/1@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6516:120:WilError_03
Source: C:\Users\user\Desktop\ugslmd.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: ugslmd.exeVirustotal: Detection: 18%
Source: unknownProcess created: C:\Users\user\Desktop\ugslmd.exe "C:\Users\user\Desktop\ugslmd.exe"
Source: C:\Users\user\Desktop\ugslmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ugslmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeSection loaded: icmp.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040101A memset,memset,memset,_umask,_getcwd,GetVersion,_chdir,sprintf,_mkdir,LoadLibraryA,GetProcAddress,sprintf,sprintf,_access,sprintf,_chdir,sprintf,_mkdir,_mkdir,sprintf,_mkdir,_chdir,sprintf,_mkdir,sprintf,_mkdir,FreeLibrary,getenv,sprintf,sprintf,_access,sprintf,_chdir,sprintf,_mkdir,_mkdir,_chdir,sprintf,_mkdir,sprintf,_chdir,sprintf,_mkdir,sprintf,_mkdir,_chdir,_umask,strlen,memcpy,strcpy,0_2_0040101A
Source: initial sampleStatic PE information: section where entry point is pointing to: .data11
Source: ugslmd.exeStatic PE information: section name: .textidx
Source: ugslmd.exeStatic PE information: section name: CONST
Source: ugslmd.exeStatic PE information: section name: .data10
Source: ugslmd.exeStatic PE information: section name: .data11
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00684C76 push 64709177h; mov dword ptr [esp], ebp0_2_00683239
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00684C76 pushfd ; mov dword ptr [esp], ebp0_2_00683735
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00684C76 pushfd ; mov dword ptr [esp], edi0_2_00683739
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00684C76 push dword ptr [esp+48h]; retn 004Ch0_2_00685340
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00684041 push dword ptr [esp+38h]; retn 003Ch0_2_00684060
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401C3A push dword ptr [esp+38h]; retn 003Ch0_2_00401C59
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040283E push dword ptr [esp+14h]; mov dword ptr [esp], 3A50C060h0_2_0040284F
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004018C9 push 27BA4E00h; mov dword ptr [esp], ebx0_2_004018DF
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004018C9 push 27BA4E00h; mov dword ptr [esp], ebx0_2_004018DF
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401CEB push 64709177h; mov dword ptr [esp], ebp0_2_00401CF0
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004018C9 push 27BA4E00h; mov dword ptr [esp], ebx0_2_004018DF
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004028F6 push 3278574Ah; mov dword ptr [esp], ecx0_2_004028FB
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402946 push dword ptr [esp+38h]; retn 003Ch0_2_005E08D5
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_005E0156 push dword ptr [esp+08h]; retn 000Ch0_2_005E016C
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_005E0563 pushad ; mov dword ptr [esp], 9A1F551Ah0_2_005E0585
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040190F pushfd ; mov dword ptr [esp], ebx0_2_00401917
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040190F push ecx; mov dword ptr [esp], ecx0_2_0040191B
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402119 push dword ptr [esp+34h]; retn 0038h0_2_00402128
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402183 push 314BF859h; mov dword ptr [esp], ebx0_2_00402196
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402183 pushfd ; mov dword ptr [esp], ecx0_2_0040219A
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004025A9 push ecx; mov dword ptr [esp], 025AC96Ch0_2_004025F3
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402641 push dword ptr [esp]; mov dword ptr [esp], esi0_2_00402659
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00402648 push dword ptr [esp]; mov dword ptr [esp], esi0_2_00402659
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401E31 pushfd ; mov dword ptr [esp], 6E2C6620h0_2_005E005D
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_004026FD push dword ptr [esp]; mov dword ptr [esp], esi0_2_00402723
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00683ABF push dword ptr [esp+34h]; retn 0038h0_2_00683ACE
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00680377 push dword ptr [esp+2Ch]; retn 0038h0_2_00680E5B
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401B2D pushfd ; mov dword ptr [esp], esi0_2_00401B46
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401B2D push 747377BDh; mov dword ptr [esp], ebp0_2_00401B4E
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401EDE push 2B9D4FAFh; mov dword ptr [esp], ebx0_2_005E1338
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401EDE push 6886B23Ah; mov dword ptr [esp], ecx0_2_005E1340
Source: ugslmd.exeStatic PE information: section name: .data11 entropy: 7.9892958796289655
Source: C:\Users\user\Desktop\ugslmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\ugslmd.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: ugslmd.exe, 00000000.00000002.1618992451.000000000088E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_0040101A memset,memset,memset,_umask,_getcwd,GetVersion,_chdir,sprintf,_mkdir,LoadLibraryA,GetProcAddress,sprintf,sprintf,_access,sprintf,_chdir,sprintf,_mkdir,_mkdir,sprintf,_mkdir,_chdir,sprintf,_mkdir,sprintf,_mkdir,FreeLibrary,getenv,sprintf,sprintf,_access,sprintf,_chdir,sprintf,_mkdir,_mkdir,_chdir,sprintf,_mkdir,sprintf,_chdir,sprintf,_mkdir,sprintf,_mkdir,_chdir,_umask,strlen,memcpy,strcpy,0_2_0040101A
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\ugslmd.exeCode function: 0_2_00401000 GetVersion,0_2_00401000

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		1
Process Injection		1
Software Packing		OS Credential Dumping1
Security Software Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory2
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432144 Sample: ugslmd.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 ugslmd.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ugslmd.exe13%ReversingLabs
ugslmd.exe18%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1432144
Start date and time:2024-04-26 15:33:22 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 56s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:2
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:ugslmd.exe
Detection:MAL
Classification:mal48.winEXE@2/1@0/0
EGA Information:Failed
HCA Information:Failed
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated

Warnings

  • Execution Graph export aborted for target ugslmd.exe, PID 7136 because there are no executed function
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File
Process:C:\Users\user\Desktop\ugslmd.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):158
Entropy (8bit):4.860800455330473
Encrypted:false
SSDEEP:3:JQ4F0nxuWCLQYUnIZJjHZbhF02WRhF8iHuhTySWYMovn:W40gLQ5n2TRhChF81zpv
MD5:4FADD1BA8EA3F26DBA74156E0FFD73E4
SHA1:96AD1043190F1C71618767F1CE0F39CF91B3D87E
SHA-256:D7A1201A82CBECDD918429499BCE842C65CDCA02D71476D6789B368A117EF817
SHA-512:3D5FE6DBD3EC0E260659F063945F4594C2C1717F2D61ECCEF4E04230E9CA6952A2BBA4F6FA34BB95DF9A4BB09AB2AB0C89DC921CC2ABAACC9FC0316A009705BD
Malicious:false
Reputation:low
Preview:15:34:07 (ugslmd) FLEXnet Licensing version v11.6.1.0 build 66138 i86_n3..15:34:07 (ugslmd) Vendor daemons must be run by the license server manager (lmgrd)..

Static File Info

General

File type:PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):7.964289450405882
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:ugslmd.exe
File size:643'072 bytes
MD5:551ed08a9076a98b16ce6dd72c993209
SHA1:7f6e01bbbfe0caa479cb9feee9cec092fd4fde9d
SHA256:b3507a576c4b7861f343a95f00e177c0aaeb44fac3400dd054fe8c0aeeeddccd
SHA512:58570764200da8757b56060d3ab7881107c791dfde23463c8f431f7b5b76e0c3e1f68b15ef09d38286071201dc478a85d003c11ba1a6346f5c1ea37aa3e2e755
SSDEEP:12288:+XK4BUw/KnGv8UMmkVmhaPHuukCfb0gLfY+SdZyJxAfjdtOpR8YUa7G:+5lKnghMmkVmhavuuk4TLfKZmedORvPK
TLSH:7DD423A388484178ECC64F7517B9A8FF9F55E368898DCA1AD251EE134C037B728DD18E
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p26y4SX*4SX*4SX*.\.*:SX*..&*?SX*4SY*&RX*..#*7SX*..6*6SX*..%*6SX*.D.*.SX*4SX*.SX*..5*;RX*.. *5SX*Rich4SX*................PE..L..

File Icon

Icon Hash:90cececece8e8eb0

Static PE Info

General

Entrypoint:0x680377
Entrypoint Section:.data11
Digitally signed:false
Imagebase:0x400000
Subsystem:windows cui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:0x4B0C27BF [Tue Nov 24 18:36:47 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:7c183f724feb3551aab2593ae1d06669

Entrypoint Preview

Instruction
pushfd
pushad
mov byte ptr [esp+08h], cl
mov dword ptr [esp+20h], 864CCD9Eh
call 00007F546CAC50D0h
stc
shl edi, 08h
test ch, dl
cmc
lea esp, dword ptr [esp+60h]
jbe 00007F546CAC5D54h
bt dx, dx
add edi, eax
push 692B9188h
sub ecx, 01h
pushfd
call 00007F546CB5BCA8h
add byte ptr [eax], al
inc esi
imul ebp, dword ptr [esi+64h], 73726946h
je 00007F546CB59798h
imul ebp, dword ptr [ebp+41h], 83DFD200h

Rich Headers

Programming Language:
  • [IMP] VS2005 build 50727
  • [C++] VS2005 build 50727
  • [ASM] VS2005 build 50727
  • [ C ] VS2003 (.NET) SP1 build 6030
  • [ C ] VS2005 build 50727
  • [LNK] VS2005 build 50727

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x2345400xc8.data11
IMAGE_DIRECTORY_ENTRY_RESOURCE0x1df0000x1ac.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x28066c0x484.data11
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000xb75cc0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.textidx0xb90000xa4cea0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
CONST0x15e0000x500x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x15f0000x94f60x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x1690000x754180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0x1df0000x1ac0x1000aa68e70a4ffee646764f17f76b69fdbfFalse0.070068359375data0.8981481885262328IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data100x1e00000xa0340x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data110x1eb0000x9a9310x9b0006c1764a4905556b2e3fb5c680221e305False0.9879819808467742data7.9892958796289655IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_MANIFEST0x1df0580x154ASCII text, with CRLF line terminatorsEnglishUnited States0.65

Imports

DLLImport
MSVCR80.dlliscntrl, isgraph, islower, isprint, ispunct, isupper, toupper, atol, clearerr, ungetc, isspace, wcscmp, memmove, _amsg_exit, __getmainargs, _cexit, _XcptFilter, __initenv, _initterm, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, isalpha, __set_app_type, ?terminate@@YAXXZ, _unlock, __dllonexit, _lock, _onexit, _decode_pointer, _except_handler4_common, _invoke_watson, _controlfp_s, _crt_debugger_hook, isalnum, _exit, strncat, sprintf_s, strncpy_s, strtoul, strcpy_s, strcat_s, isxdigit, isdigit, _beginthread, _endthread, _putenv, _wunlink, _wremove, _waccess, strcpy, _wrename, rename, _wstat32, _close, _wopen, _wfreopen, freopen, _wfopen, getchar, _popen, fgetc, perror, exit, _mktime32, _findfirst32, _findnext32, _stat32, _findclose, qsort, longjmp, tolower, fflush, srand, rand, _environ, strtol, __sys_nerr, __sys_errlist, fprintf, __iob_func, abs, _localtime32, _setjmp3, _errno, strrchr, strchr, sscanf, strcat, fgets, strstr, strtok, strncmp, realloc, calloc, _vsnprintf, vsprintf, atoi, strncpy, _time32, strcmp, fseek, ftell, malloc, fread, fputs, fputc, vfprintf, _beginthreadex, _utime32, _locking, _unlink, _open, _stricmp, _strdup, _getpid, _umask, memcmp, remove, free, fopen, fwrite, fclose, memset, _getcwd, _chdir, sprintf, _mkdir, _access, getenv, strlen, memcpy, _encode_pointer, _strnicmp
KERNEL32.dllDeleteFileA, SetConsoleTitleA, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentThreadId, QueryPerformanceCounter, SetUnhandledExceptionFilter, InterlockedCompareExchange, InterlockedExchange, ReleaseSemaphore, OpenSemaphoreA, CreateSemaphoreA, SearchPathA, GetFileSize, LocalFree, LocalAlloc, GetLocalTime, SystemTimeToFileTime, GetSystemTime, GetModuleFileNameA, GetCurrentProcessId, SetLastError, FindClose, FindNextFileA, FindNextFileW, FindFirstFileA, FindFirstFileW, GetModuleHandleA, GetProcessTimes, CreateMutexA, ReleaseMutex, SetHandleInformation, SetErrorMode, GetEnvironmentVariableW, GetEnvironmentVariableA, GetCommandLineW, WideCharToMultiByte, MultiByteToWideChar, VirtualFree, VirtualAlloc, GetCurrentProcess, GetDriveTypeA, GetVolumeInformationA, GetSystemDirectoryA, FormatMessageA, SetEvent, CreateEventA, ResetEvent, Sleep, GetWindowsDirectoryA, DeviceIoControl, WriteFile, ReadFile, CreateFileA, GetLastError, CloseHandle, GetTickCount, GetPrivateProfileIntA, GetPrivateProfileStringA, GetVersionExA, LoadLibraryA, GetProcAddress, FreeLibrary, GetVersion, WaitForSingleObject
USER32.dllDialogBoxIndirectParamA, CreateDialogIndirectParamA, wsprintfA, GetClientRect, ScreenToClient, GetSystemMetrics, MessageBoxA, MoveWindow, ShowWindow, EnableWindow, GetWindowRect, GetDlgItem, SendMessageA, GetWindowLongA, MessageBeep, SetDlgItemTextA, GetDlgItemTextW, GetDlgItemTextA, EndDialog, GetParent, GetFocus, SetFocus, SetWindowTextA, GetActiveWindow
NETAPI32.dllNetbios
ADVAPI32.dllRegQueryValueExA, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegCloseKey, GetUserNameA, RegDeleteValueA, RegEnumValueA, RegQueryValueExW, RegSetValueExW, GetUserNameW, RegEnumKeyExA, RegQueryInfoKeyA, DeregisterEventSource, RegisterEventSourceA, ReportEventA
comdlg32.dllGetOpenFileNameA
COMCTL32.dll
WSOCK32.dllgetsockopt, ntohs, select, connect, socket, closesocket, recv, send, inet_ntoa, setsockopt, getservbyport, gethostbyaddr, gethostbyname, WSAGetLastError, ioctlsocket, htons, getservbyname, inet_addr, WSASetLastError, htonl, ntohl, WSAStartup, gethostname, WSACleanup, getprotobyname, getsockname, __WSAFDIsSet
KERNEL32.dllGetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:15:34:07
Start date:26/04/2024
Path:C:\Users\user\Desktop\ugslmd.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\ugslmd.exe"
Imagebase:0x400000
File size:643'072 bytes
MD5 hash:551ED08A9076A98B16CE6DD72C993209
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

General

Target ID:1
Start time:15:34:07
Start date:26/04/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff7699e0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Disassembly

Reset < >

    Non-executed Functions

    Function 0040101A Relevance: 94.8, APIs: 45, Strings: 9, Instructions: 252librarystringloaderCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID: sprintf$_mkdir$_chdir$memset$Library_access_umask$AddressFreeLoadProcVersion_getcwdgetenvmemcpystrcpystrlen
    • String ID: %s\Application Data$%s\Application Data\Macrovision$%s\Application Data\Macrovision\FLEXlm$%s\Macrovision$%s\Macrovision\FLEXlm$ALLUSERSPROFILES$SHGetFolderPathA$c:\flexlm$shfolder.dll
    • API String ID: 2222192420-931088569
    • Opcode ID: 91c5ed8a793844ad43ca88a149602b061be267c3a66d2c8d11898840df97ac73
    • Instruction ID: 32af0d676369e95eb50fdb7e4b33035bc9654a75c7a67bb582201e9558f9a8a1
    • Opcode Fuzzy Hash: 91c5ed8a793844ad43ca88a149602b061be267c3a66d2c8d11898840df97ac73
    • Instruction Fuzzy Hash: 218143B1C0021CAADF10EBA4DC99DDE7BBCAB15315F0045B7F555E2090E674DB889FA0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID: Version
    • String ID:
    • API String ID: 1889659487-0
    • Opcode ID: 589ff2ffb51fe281eab3f901c417d301c0d1860df2913a02576c5adbc469cbc5
    • Instruction ID: db9ec540bafd196bfff6e00a690b0243c1944418628b8631b94087d3fbd062c7
    • Opcode Fuzzy Hash: 589ff2ffb51fe281eab3f901c417d301c0d1860df2913a02576c5adbc469cbc5
    • Instruction Fuzzy Hash: 32B092629F148649EA0029348818778128AA3A230BF900D70E0E3C10A8EE2880CB7608
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403D15 Relevance: .2, Instructions: 235COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 1b9827c0a5dc4ee93e6977c117e545b2d663892557609d6e28165fde0bd6e527
    • Instruction ID: a6008b775ea0e8b3e0fbe34bd833c99075f9983ff509901d3d9709f64fd5633c
    • Opcode Fuzzy Hash: 1b9827c0a5dc4ee93e6977c117e545b2d663892557609d6e28165fde0bd6e527
    • Instruction Fuzzy Hash: 8AC162B0504094CFEB05CF11EE935AD7BF3AFF9200B1DA192D8807A2A5D7306A69EF55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00407213 Relevance: .2, Instructions: 232COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 679b3f35d1a76373d57cafe3a0535117509c1bce257e9d960c8ec884d146ba54
    • Instruction ID: 5ecc78cec5a09345a97de078a38a236791888f55c078600c50f7f0eeb3784f0e
    • Opcode Fuzzy Hash: 679b3f35d1a76373d57cafe3a0535117509c1bce257e9d960c8ec884d146ba54
    • Instruction Fuzzy Hash: 90C18D70904084CFEB05CF51EE9356D7BF3AFF5304B199192C8807A2A6D7306A6AEF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00409AA9 Relevance: .2, Instructions: 155COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2f1a762cdb9cae25fca2518f76b761c8c863ea383c5ddd8d1550d990fb2fd8de
    • Instruction ID: 0f59991d40333b4aeb2c6dc089c60f4a22fe303f615e826ff7b6e6e055f2a77f
    • Opcode Fuzzy Hash: 2f1a762cdb9cae25fca2518f76b761c8c863ea383c5ddd8d1550d990fb2fd8de
    • Instruction Fuzzy Hash: 1E719170500195CFEB05CF25EA9267D7BF2AFB5300F189192D8407B296D330AE6AEF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0040652E Relevance: .2, Instructions: 152COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 9a48c79cbc5745f2f9f402f41f74c725fffddd25f0bfc787a2bf8c2be28a2c64
    • Instruction ID: afae463e1bef410ce7b3e4dd5df78d50f131497ade03d4a1ab24fc288790698d
    • Opcode Fuzzy Hash: 9a48c79cbc5745f2f9f402f41f74c725fffddd25f0bfc787a2bf8c2be28a2c64
    • Instruction Fuzzy Hash: F8719370500084CFEB05CF55EA925AD7BF3AFF53087189152D8417B2A9D3306E29EF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00405645 Relevance: .1, Instructions: 128COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 563429a6b7b045eeff24a57971489f5dbeb947817be667ce900a6d4937199541
    • Instruction ID: 75eb0027cb1e0f84c30bd752f020f1304e5783391f6d0c9a594ab6d783a7b76c
    • Opcode Fuzzy Hash: 563429a6b7b045eeff24a57971489f5dbeb947817be667ce900a6d4937199541
    • Instruction Fuzzy Hash: E4514070604084CFEB05CF55EA9256D7BF3AFF5304B5C9192C8407B2A6D7306A2AEF66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00408064 Relevance: .1, Instructions: 120COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 070b934d2af1e062058c92da8b2dd315153e8eb1982b73010430ad9b0f974774
    • Instruction ID: e2bd038657e5b47a966e37d31c7aabc446da3c37c3c6c76f73be43f7b2f7a06c
    • Opcode Fuzzy Hash: 070b934d2af1e062058c92da8b2dd315153e8eb1982b73010430ad9b0f974774
    • Instruction Fuzzy Hash: 94514170504094CFE705CF11EE9265E7BF2AFB5300F1D9192C884BA296D7306E69EF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402D97 Relevance: .1, Instructions: 120COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: a1e2bc13be797127784942b57720a6f4a71c61e5d7b6f74d32ecb6d7fea5dd2e
    • Instruction ID: 2ca99901a108b44a845ee9e8fb68787bd813a19c8e1115c296138c3c87a45499
    • Opcode Fuzzy Hash: a1e2bc13be797127784942b57720a6f4a71c61e5d7b6f74d32ecb6d7fea5dd2e
    • Instruction Fuzzy Hash: F3514D70504084CFEB05CF51EA979AD7BF3AFF92007189152DC407A2A5D3346E2AEF66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00405601 Relevance: .1, Instructions: 118COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 827c174240033a0e09acee80887279fe0f39a993891fd70eef714c8568b38a21
    • Instruction ID: b1da5659b9fe1cc8d49c94a7f23991931c2d33f275c34b32027f156f29869339
    • Opcode Fuzzy Hash: 827c174240033a0e09acee80887279fe0f39a993891fd70eef714c8568b38a21
    • Instruction Fuzzy Hash: 4E513D70604084CFEB05CF65EA9256D7BF3EFF530475CA152D8407A2A6D3306A2AEF66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00404221 Relevance: .1, Instructions: 118COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 3fc28d0b9dc559aac938f7a49b727e151b966c3cafaea5468ee1ffc2a1bcc8e7
    • Instruction ID: 2268d50b8899adf5e2256e15e038fe04e1b6f11a33c6083aa0632c91c7139a99
    • Opcode Fuzzy Hash: 3fc28d0b9dc559aac938f7a49b727e151b966c3cafaea5468ee1ffc2a1bcc8e7
    • Instruction Fuzzy Hash: 525124B0504084CFE705CF55EA935AD7BF3AFF920075C9192D840BA2E6D330692AEF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004051B4 Relevance: .1, Instructions: 118COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 28c573816f646189c0bafab673eace1d903d34236d1c8b49881a69bbc2533a10
    • Instruction ID: 873975866bc19f079ecbfd08d3f5a7118f9e1231bbf89cf75d1d1230077e5221
    • Opcode Fuzzy Hash: 28c573816f646189c0bafab673eace1d903d34236d1c8b49881a69bbc2533a10
    • Instruction Fuzzy Hash: E1512C70500084CFEB05CF91EA9396E7BF3AFF5304718A152DC407A2A9D3306A6AEF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004092BC Relevance: .1, Instructions: 117COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: d68b686ad745718782a7a1574ffb7cef1c02759f954d8b82543bf1a2b7eccbb1
    • Instruction ID: 406fca21fa57edc56c34b131e8cdd147729901ae559178d95f3cd1d6aab3494d
    • Opcode Fuzzy Hash: d68b686ad745718782a7a1574ffb7cef1c02759f954d8b82543bf1a2b7eccbb1
    • Instruction Fuzzy Hash: 9A512170504094CFE705CF11EE92A6DBBB2ABF5200F18D192C884BB296D7306E69EF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00408F6C Relevance: .1, Instructions: 117COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: d070f6289254e0d2851da122664b8d6bb18676a092ff411ee3c3dfa1973c6121
    • Instruction ID: c6623d1ab9ac0264d5ce6559499227fd59317f8dfe49a69d1a133678e70dd924
    • Opcode Fuzzy Hash: d070f6289254e0d2851da122664b8d6bb18676a092ff411ee3c3dfa1973c6121
    • Instruction Fuzzy Hash: 8D514470500095CFE706CF11EE9269D7BF3ABF5200F1891D2D884BA296D730AE59EF55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00409F0B Relevance: .1, Instructions: 117COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 22ea7de8c7f4e274be746ff90ea7746feff355652306ae22d648fd9205a44d04
    • Instruction ID: 06b2022da843e5cd5f572b50ab8681336425cd2e202be83fb3b09e4b24838a7b
    • Opcode Fuzzy Hash: 22ea7de8c7f4e274be746ff90ea7746feff355652306ae22d648fd9205a44d04
    • Instruction Fuzzy Hash: 0E516F70500095CFE705CF11EE9266D7BF3AFF5200F089192D881BA2A6D7306EA9EF52
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00408911 Relevance: .1, Instructions: 116COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 9a90425789ba04d3b016109e7526dfe854126496e1fffd1e8f917171a8eb1644
    • Instruction ID: f3459092bc9d476e06a901a074c51892256420703cde94be5525719443d29a59
    • Opcode Fuzzy Hash: 9a90425789ba04d3b016109e7526dfe854126496e1fffd1e8f917171a8eb1644
    • Instruction Fuzzy Hash: CE517170600094CFEB05CF11EE9666D7BF3ABF5200F1D9182D884BA2A5D7306E6AEF55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0040807B Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 922edaa66645a3eda45319e77be83a47d36eb496785e1e1996188a21d06052fe
    • Instruction ID: 39ebced604ad8cbf3f93e5bcf6322fe711413f1c17ad62c4e95bbedff61acc0d
    • Opcode Fuzzy Hash: 922edaa66645a3eda45319e77be83a47d36eb496785e1e1996188a21d06052fe
    • Instruction Fuzzy Hash: 7C513170500054CFEB05CF11EE9265D7BF2AFB5300F199196C884BA2A6D7306E69EF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0040721E Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 044eb7b376c63127ef58a05c79acde127bd87c443b055bb67cc0894bb15007f1
    • Instruction ID: be6ba1f0d3c976f291b7667cccc9a400bcf00394c43216cff96bae4715784937
    • Opcode Fuzzy Hash: 044eb7b376c63127ef58a05c79acde127bd87c443b055bb67cc0894bb15007f1
    • Instruction Fuzzy Hash: 8D512D70904084CFEB05CF95EA9356DBBF3AFF53047189152DC507A2AAD3306A2AEF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00404234 Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2a5f1dcd175b87058b749df13aff564b47be3e21293b82efa49e83e48c5d461b
    • Instruction ID: 117def84ac032aaa62281758319cdf784c09c47b4e2232789434c9f1f2763a0c
    • Opcode Fuzzy Hash: 2a5f1dcd175b87058b749df13aff564b47be3e21293b82efa49e83e48c5d461b
    • Instruction Fuzzy Hash: 6C5103B0504084CFEB05CF55EA935AD7BF3AFF920475CA152D840BA2E6E3306929EF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00407039 Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: fdb0cd00b5c8b15612b031ba724f8fd1afec5cff9580a2b9c3a4fbf72025802a
    • Instruction ID: 876922ecf5b581b92417ce7816224b439d88822538cb38431e130996adb53cde
    • Opcode Fuzzy Hash: fdb0cd00b5c8b15612b031ba724f8fd1afec5cff9580a2b9c3a4fbf72025802a
    • Instruction Fuzzy Hash: 30511E70904084CFFB06CF55EA925AD7BF3AFF53047189152D8407A2AAD3306A6AEF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004092CB Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: df4b80b37c563cd7749ef6287ed2f7ef566d05b6d0ed1c0a3756484def5c82da
    • Instruction ID: e09f8b55f01704488b96bc17d42e25cc61de188bcd4360cfcfe01a3a515e43d1
    • Opcode Fuzzy Hash: df4b80b37c563cd7749ef6287ed2f7ef566d05b6d0ed1c0a3756484def5c82da
    • Instruction Fuzzy Hash: CC512270504054CFE705CF12EE92A5DBBF2ABF5200F18D192D884B6296D7306E69EF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00407D5C Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 12d9d6d50c65ab59ccc90e7caaa98599a16954fd06d603c52a709b7bf02be889
    • Instruction ID: 5d5d82bfe1a6d0366f7d0409f626dc04c3ed391b950753a9d49a09c527eec06b
    • Opcode Fuzzy Hash: 12d9d6d50c65ab59ccc90e7caaa98599a16954fd06d603c52a709b7bf02be889
    • Instruction Fuzzy Hash: A7515F705040948FEB15CF11EE92A6D7BF3AFF5301F089182D884BA2A5D7306E69EF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00408F7A Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 321ea009dfa76e50a9dd4e1ab1fdf1727609a3413700ef70054a48814450506c
    • Instruction ID: 62950e13f8b55da9dfcf629cbde56ff31dea205a18e62a9adadc22e34f5240c3
    • Opcode Fuzzy Hash: 321ea009dfa76e50a9dd4e1ab1fdf1727609a3413700ef70054a48814450506c
    • Instruction Fuzzy Hash: 055122705000558FE705CF11EE9269E7BF3ABF5200F1891D2D884BA2A6D730AE69EF55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0040330A Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 7eeb3b72d48f8867a4fc75b0e747f0728630fe50224f635f7d1164899b48920b
    • Instruction ID: 74edb0787572caa3f67097cf641ef8c510f81dfd8aeec6b14eb8c4967adfa7ab
    • Opcode Fuzzy Hash: 7eeb3b72d48f8867a4fc75b0e747f0728630fe50224f635f7d1164899b48920b
    • Instruction Fuzzy Hash: 41516370600184CFEB05CF55EA935AD7BF3AFF930571C9152D8407A2A6D3306A2AEF66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00409F1A Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 7a5a44b766f7631d0a02fee43b6208c0a5f1ac61b38358735454f3574416c8de
    • Instruction ID: 5156f4107456135ab5861f64c921f515cce1a3fb3b51f0465c885a3e1e91ab01
    • Opcode Fuzzy Hash: 7a5a44b766f7631d0a02fee43b6208c0a5f1ac61b38358735454f3574416c8de
    • Instruction Fuzzy Hash: DC517F70500094CFEB05CF11EE9266D7BF3AFF5200F089182D880BA2A6D7306EA9EF51
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0040891E Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: fb14d0e2c9b616d3679c6b59be095fec15b0d08b49e428300a03389078022dea
    • Instruction ID: a43cc3917b46f7c0bb47478ef4dba572b5111adf38c722105baf98580f8f8efc
    • Opcode Fuzzy Hash: fb14d0e2c9b616d3679c6b59be095fec15b0d08b49e428300a03389078022dea
    • Instruction Fuzzy Hash: 61515E70600094CFEB05CF11EE9666D7BF3ABF5200F1D9182D884BA2A6D7306E69EF55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403D25 Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 115a23eab3b3be36eab42224e157f31c7f2e5c1e8e979178262ae482403c90d2
    • Instruction ID: 899f35a1928a27f6467e75c16e1fcc4fc46118cf752cde927248f19d9b3b0d2c
    • Opcode Fuzzy Hash: 115a23eab3b3be36eab42224e157f31c7f2e5c1e8e979178262ae482403c90d2
    • Instruction Fuzzy Hash: 85513EB0500084CFEB05CF55EA935AD7FF3AFF9211B1CA152D8407A2A6D3306A69EF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00406539 Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: e460ff2dcd5d4ced00a0469fa5129f7730734a13d1bbddc463623e3d2498aabe
    • Instruction ID: e1bbce26bba0d7cd348bf4e4ee177e416028223b6aad30ee9f3f930ac23aefa2
    • Opcode Fuzzy Hash: e460ff2dcd5d4ced00a0469fa5129f7730734a13d1bbddc463623e3d2498aabe
    • Instruction Fuzzy Hash: 04513270600084CFEB05CF95EA975AD7BF3AFF530871D9152D8407A2A9D3306A2AEF55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004051CC Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: de798bf7694f93c62c5c603b13b216c1fab5b4a77371e09a0f21b77289489d1b
    • Instruction ID: 96ffc550b3d4f26cbfa12152ad6ec8ecf9780c99ef239e12afcbb671429ca478
    • Opcode Fuzzy Hash: de798bf7694f93c62c5c603b13b216c1fab5b4a77371e09a0f21b77289489d1b
    • Instruction Fuzzy Hash: 78510B70500084CFEB05CF95EA9396D7BF3AFF5304758A192DC407A2AAD3306A29EF56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402DAE Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: d09958ad5d2c82912c8ee1d3b12bb0689e1232b5a2f93d5e4aa8e76594647f4f
    • Instruction ID: d239cab1897ace6f81cbc04d96d08b165a57dbac983ba141d1f6880c4aacbea0
    • Opcode Fuzzy Hash: d09958ad5d2c82912c8ee1d3b12bb0689e1232b5a2f93d5e4aa8e76594647f4f
    • Instruction Fuzzy Hash: 8C512B70500084CFEB05CF55EA939AD7BF3AFF92007189152DC407A2A6D3346E2AEF66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004047B3 Relevance: .1, Instructions: 115COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2cf05c6f50b02fb674a98c4670d09f1fe7a5aed8283bf7981a549beb851b6314
    • Instruction ID: e559693163b06dcb357c42ebf7028cb8e3574833c6831bde2b23199b663b60fd
    • Opcode Fuzzy Hash: 2cf05c6f50b02fb674a98c4670d09f1fe7a5aed8283bf7981a549beb851b6314
    • Instruction Fuzzy Hash: A45131B0904084CFEB05CF65EA935ADBBF3AFF920471CD152D8507A2A5D3306A29EF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004013FE Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 170fileCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID: memset$fclosememcpy$_umaskfopenfreefseeksprintf$Version_chdir_getcwd_mkdirfreadftellfwritemallocmemcmpremovestrlen
    • String ID: %s%s%sborrow$ugslmd
    • API String ID: 3305773805-1276635079
    • Opcode ID: c16e31ec32c749a77e0fea755afe38c05345df49b9267b19a20d835068967304
    • Instruction ID: d62a0d0c8fc60f9757ffdb56edd5451af6f7271ec639103f7a047dcd5274787d
    • Opcode Fuzzy Hash: c16e31ec32c749a77e0fea755afe38c05345df49b9267b19a20d835068967304
    • Instruction Fuzzy Hash: 7F51BCB1C40219BFDF11ABA1CC89EDEBBBCEF10306F1044BAF504B2190EA785B459B64
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401608 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 83fileCOMMON
    Download Yara Rule
    APIs
    • memset.MSVCR80 ref: 0040162A
    • memset.MSVCR80 ref: 0040163E
      • Part of subcall function 0040101A: memset.MSVCR80 ref: 0040103C
      • Part of subcall function 0040101A: memset.MSVCR80 ref: 00401050
      • Part of subcall function 0040101A: memset.MSVCR80 ref: 00401064
      • Part of subcall function 0040101A: _umask.MSVCR80 ref: 0040106A
      • Part of subcall function 0040101A: _getcwd.MSVCR80 ref: 0040107F
      • Part of subcall function 0040101A: GetVersion.KERNEL32 ref: 00401088
      • Part of subcall function 0040101A: sprintf.MSVCR80 ref: 004010B6
      • Part of subcall function 0040101A: _mkdir.MSVCR80 ref: 004010C3
      • Part of subcall function 0040101A: _chdir.MSVCR80 ref: 00401312
      • Part of subcall function 0040101A: _umask.MSVCR80 ref: 00401317
      • Part of subcall function 0040101A: strlen.MSVCR80 ref: 00401324
      • Part of subcall function 0040101A: memcpy.MSVCR80 ref: 00401341
    • sprintf.MSVCR80 ref: 00401671
    • fopen.MSVCR80 ref: 00401683
    • fseek.MSVCR80 ref: 0040169C
    • ftell.MSVCR80 ref: 0040169F
    • fseek.MSVCR80 ref: 004016AB
    • malloc.MSVCR80 ref: 004016B1
    • fread.MSVCR80 ref: 004016C8
    • fclose.MSVCR80 ref: 004016DE
    • remove.MSVCR80(?), ref: 004016EC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID: memset$_umaskfseeksprintf$Version_chdir_getcwd_mkdirfclosefopenfreadftellmallocmemcpyremovestrlen
    • String ID: %s%s%sborrow$ugslmd
    • API String ID: 2983545582-1276635079
    • Opcode ID: 70e4f502b9f0a18f1b5b4687a1f91390c94ade9c55ca6b0d626f387be5767754
    • Instruction ID: f0319ef880ef4d8528e50dde3c8f056718249941fbea1002a446d15c706cc13e
    • Opcode Fuzzy Hash: 70e4f502b9f0a18f1b5b4687a1f91390c94ade9c55ca6b0d626f387be5767754
    • Instruction Fuzzy Hash: 4721DEB6901218BFDB10AFA58C89EDF7BBCEB14346F0404A6F504E3151D6B89E888B60
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401358 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 48fileCOMMON
    Download Yara Rule
    APIs
    • memset.MSVCR80 ref: 00401378
    • memset.MSVCR80 ref: 0040138E
      • Part of subcall function 0040101A: memset.MSVCR80 ref: 0040103C
      • Part of subcall function 0040101A: memset.MSVCR80 ref: 00401050
      • Part of subcall function 0040101A: memset.MSVCR80 ref: 00401064
      • Part of subcall function 0040101A: _umask.MSVCR80 ref: 0040106A
      • Part of subcall function 0040101A: _getcwd.MSVCR80 ref: 0040107F
      • Part of subcall function 0040101A: GetVersion.KERNEL32 ref: 00401088
      • Part of subcall function 0040101A: sprintf.MSVCR80 ref: 004010B6
      • Part of subcall function 0040101A: _mkdir.MSVCR80 ref: 004010C3
      • Part of subcall function 0040101A: _chdir.MSVCR80 ref: 00401312
      • Part of subcall function 0040101A: _umask.MSVCR80 ref: 00401317
      • Part of subcall function 0040101A: strlen.MSVCR80 ref: 00401324
      • Part of subcall function 0040101A: memcpy.MSVCR80 ref: 00401341
    • sprintf.MSVCR80 ref: 004013C1
    • fopen.MSVCR80 ref: 004013D3
    • fwrite.MSVCR80 ref: 004013EB
    • fclose.MSVCR80 ref: 004013F2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1618470550.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1618446728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618557386.000000000055F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000569000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.000000000057B000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618572949.0000000000590000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618644003.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618657966.00000000005E0000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618672768.00000000005EB000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618699595.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618712922.0000000000636000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618740267.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618753543.0000000000681000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618767385.0000000000684000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1618821638.0000000000685000.00000080.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_ugslmd.jbxd
    Similarity
    • API ID: memset$_umasksprintf$Version_chdir_getcwd_mkdirfclosefopenfwritememcpystrlen
    • String ID: %s%s%sborrow$ugslmd
    • API String ID: 141925255-1276635079
    • Opcode ID: 8f65d2792cda3d82b5ee6dba5782a755361ef367236f954458eaf5bd64307718
    • Instruction ID: b84fd5cd67ff922eb64e2aff5c52a8e1f24b893dddadc45b24005e2c57231e1b
    • Opcode Fuzzy Hash: 8f65d2792cda3d82b5ee6dba5782a755361ef367236f954458eaf5bd64307718
    • Instruction Fuzzy Hash: 4F0156B19413286BDB10AB64DC5DFCE7B6CAB14706F0400A2BA59F2191E6B497888B94
    Uniqueness

    Uniqueness Score: -1.00%