Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
J7XIGd3DCJ.exe

Overview

General Information

Sample name:J7XIGd3DCJ.exe
renamed because original name is a hash value
Original sample name:19d8a91e9b3652cfc0bb5165e5c3ff52.exe
Analysis ID:1431902
MD5:19d8a91e9b3652cfc0bb5165e5c3ff52
SHA1:649f59eae10939df994db941aabc1fb78f6a0aae
SHA256:a7026eb135336fc541bb8cf376de89754873bfe36cba3098fbd6bdfb8c22a89d
Tags:DCRatexe
Infos:

Detection

DCRat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Execution from Suspicious Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • J7XIGd3DCJ.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\J7XIGd3DCJ.exe" MD5: 19D8A91E9B3652CFC0BB5165E5C3FF52)
    • schtasks.exe (PID: 4548 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\Registry.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7180 cmdline: schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7228 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7296 cmdline: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7324 cmdline: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsX" /sc ONLOGON /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7344 cmdline: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7364 cmdline: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 13 /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7380 cmdline: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsX" /sc ONLOGON /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7396 cmdline: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • cmd.exe (PID: 7668 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • w32tm.exe (PID: 7720 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)
      • BfsBBmsxHEOpauZphVFNsX.exe (PID: 7824 cmdline: "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe" MD5: 58AB2ACD0ED54008D68BBF03FCCC4BBF)
  • Registry.exe (PID: 7460 cmdline: C:\Recovery\Registry.exe MD5: 757CD80AA5AFC0AEEDD8B162676E0B85)
  • Registry.exe (PID: 7504 cmdline: C:\Recovery\Registry.exe MD5: 757CD80AA5AFC0AEEDD8B162676E0B85)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"6\":\"|\",\"L\":\";\",\"0\":\"*\",\"U\":\"(\",\"S\":\"&\",\"C\":\",\",\"E\":\"@\",\"e\":\">\",\"J\":\"-\",\"W\":\"_\",\"1\":\")\",\"I\":\"!\",\"9\":\".\",\"R\":\"`\",\"i\":\"~\",\"x\":\" \",\"Q\":\"$\",\"k\":\"^\",\"d\":\"%\",\"z\":\"<\",\"n\":\"#\"}", "PCRT": "{\"U\":\"`\",\"B\":\"&\",\"Z\":\"$\",\"F\":\"#\",\"G\":\"*\",\"5\":\"~\",\"Q\":\"%\",\"R\":\"(\",\"x\":\"-\",\"z\":\"@\",\"a\":\">\",\"J\":\";\",\"n\":\"|\",\"1\":\"_\",\"0\":\"!\",\"V\":\")\",\"L\":\"<\",\"3\":\",\",\"N\":\".\",\"b\":\" \",\"E\":\"^\"}", "TAG": "", "MUTEX": "DCR_MUTEX-6UvKQOW7INlJAQzyojbi", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": true, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": true, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": true, "ASO": false, "AD": false, "H1": "http://cz24519.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "H2": "http://cz24519.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "T": "0"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000014.00000002.1859128791.0000000002EE1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
    00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
      00000010.00000002.1779968766.0000000002901000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
        00000000.00000002.1714090175.0000000002BC1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
          00000014.00000002.1859128791.0000000002F1F000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
            Click to see the 10 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.J7XIGd3DCJ.exe.2c97af8.5.raw.unpackINDICATOR_SUSPICIOUS_References_SecTools_B64EncodedDetects executables referencing many base64-encoded IR and analysis tools namesditekSHen
            • 0x164ec:$s4: cHJvY2V4cA
            • 0x16e34:$s4: cHJvY2V4cA
            • 0x1652d:$s5: cHJvY2V4cDY0
            • 0x16e75:$s5: cHJvY2V4cDY0
            • 0x16429:$s12: d2lyZXNoYXJr
            • 0x16d71:$s12: d2lyZXNoYXJr
            • 0x162d2:$s23: ZG5zcHk
            • 0x16c1a:$s23: ZG5zcHk
            • 0x162db:$s25: aWxzcHk
            • 0x16c23:$s25: aWxzcHk
            • 0x162e4:$s26: ZG90cGVla
            • 0x16c2c:$s26: ZG90cGVla

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Execution from Suspicious Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe" , CommandLine: "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe, NewProcessName: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe, OriginalFileName: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7668, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe" , ProcessId: 7824, ProcessName: BfsBBmsxHEOpauZphVFNsX.exe
            Sigma detected: Suspicious Schtasks From Env Var Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /f, CommandLine: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\J7XIGd3DCJ.exe", ParentImage: C:\Users\user\Desktop\J7XIGd3DCJ.exe, ParentProcessId: 6816, ParentProcessName: J7XIGd3DCJ.exe, ProcessCommandLine: schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /f, ProcessId: 7296, ProcessName: schtasks.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: J7XIGd3DCJ.exeAvira: detected
            Antivirus detection for dropped file
            Source: C:\Recovery\RCX4C45.tmpAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.batAvira: detection malicious, Label: BAT/Delbat.C
            Source: C:\Users\user\Desktop\RCX43F5.tmpAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\Recovery\Registry.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\Users\Public\Libraries\RCX4956.tmpAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\Recovery\RCX4657.tmpAvira: detection malicious, Label: HEUR/AGEN.1323984
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
            Found malware configuration
            Source: 00000000.00000002.1715243053.0000000012BCD000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: DCRat {"SCRT": "{\"6\":\"|\",\"L\":\";\",\"0\":\"*\",\"U\":\"(\",\"S\":\"&\",\"C\":\",\",\"E\":\"@\",\"e\":\">\",\"J\":\"-\",\"W\":\"_\",\"1\":\")\",\"I\":\"!\",\"9\":\".\",\"R\":\"`\",\"i\":\"~\",\"x\":\" \",\"Q\":\"$\",\"k\":\"^\",\"d\":\"%\",\"z\":\"<\",\"n\":\"#\"}", "PCRT": "{\"U\":\"`\",\"B\":\"&\",\"Z\":\"$\",\"F\":\"#\",\"G\":\"*\",\"5\":\"~\",\"Q\":\"%\",\"R\":\"(\",\"x\":\"-\",\"z\":\"@\",\"a\":\">\",\"J\":\";\",\"n\":\"|\",\"1\":\"_\",\"0\":\"!\",\"V\":\")\",\"L\":\"<\",\"3\":\",\",\"N\":\".\",\"b\":\" \",\"E\":\"^\"}", "TAG": "", "MUTEX": "DCR_MUTEX-6UvKQOW7INlJAQzyojbi", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": true, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": true, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": true, "ASO": false, "AD": false, "H1": "http://cz24519.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "H2": "http://cz24519.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "T": "0"}
            Multi AV Scanner detection for dropped file
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeReversingLabs: Detection: 81%
            Source: C:\Recovery\Registry.exeReversingLabs: Detection: 81%
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeReversingLabs: Detection: 81%
            Multi AV Scanner detection for submitted file
            Source: J7XIGd3DCJ.exeReversingLabs: Detection: 87%
            Machine Learning detection for dropped file
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeJoe Sandbox ML: detected
            Source: C:\Recovery\Registry.exeJoe Sandbox ML: detected
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: J7XIGd3DCJ.exeJoe Sandbox ML: detected
            Source: J7XIGd3DCJ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: J7XIGd3DCJ.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\AppData\LocalJump to behavior

            Networking

            barindex
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: http://cz24519.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002D41000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 0.2.J7XIGd3DCJ.exe.2c97af8.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8BC4580_2_00007FFD9B8BC458
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8BAA600_2_00007FFD9B8BAA60
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8BA46D0_2_00007FFD9B8BA46D
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8BC4AB0_2_00007FFD9B8BC4AB
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8B99930_2_00007FFD9B8B9993
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8BA8ED0_2_00007FFD9B8BA8ED
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8BA8800_2_00007FFD9B8BA880
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8B80330_2_00007FFD9B8B8033
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8B99690_2_00007FFD9B8B9969
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeCode function: 13_2_00007FFD9B8A803313_2_00007FFD9B8A8033
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeCode function: 14_2_00007FFD9B8B803314_2_00007FFD9B8B8033
            Source: C:\Recovery\Registry.exeCode function: 15_2_00007FFD9B88803315_2_00007FFD9B888033
            Source: C:\Recovery\Registry.exeCode function: 16_2_00007FFD9B87803316_2_00007FFD9B878033
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeCode function: 20_2_00007FFD9B8A803320_2_00007FFD9B8A8033
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1715243053.0000000013612000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename$ vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720412894.000000001BBC0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002D41000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002D41000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUserPingCounter.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1713913112.0000000002B30000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002D27000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDisableUAC.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720309523.000000001BBA0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilename$ vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002D56000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVPNGrabber.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002CE6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002CE6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClipboardLogger.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720570292.000000001BC00000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720602003.000000001BC60000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameUserPingCounter.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002CC0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBuildInstallationTweaksPlugin.dll\ vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1713937220.0000000002B40000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameBuildInstallationTweaksPlugin.dll\ vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002C42000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename@s vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewCKri45K0MmlAQk2blhn.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamerRIaTJez6NooAdZtWhQx7nO.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamea4azgoqXUP2f4.exe vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamea4azgoqXUP2f4.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekBGkPGif6yU.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1719620875.000000001BAA0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekBGkPGif6yU.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000000.1652397091.000000000089E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamenQQG0kmKpIfoc0iX.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720919765.000000001BE45000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720628739.000000001BC70000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameVPNGrabber.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720510433.000000001BBF0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDisableUAC.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720464268.000000001BBE0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilename( vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1714035385.0000000002BA0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameClipboardLogger.dclib4 vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exeBinary or memory string: OriginalFilenamenQQG0kmKpIfoc0iX.exeD vs J7XIGd3DCJ.exe
            Source: J7XIGd3DCJ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 0.2.J7XIGd3DCJ.exe.2c97af8.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
            Source: J7XIGd3DCJ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: Registry.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: BfsBBmsxHEOpauZphVFNsX.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: BfsBBmsxHEOpauZphVFNsX.exe0.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: RCX43F5.tmp.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: J7XIGd3DCJ.exe, g20gCyaNN52MPVk100e.csCryptographic APIs: 'TransformBlock'
            Source: J7XIGd3DCJ.exe, g20gCyaNN52MPVk100e.csCryptographic APIs: 'TransformFinalBlock'
            Source: J7XIGd3DCJ.exe, v30YUPM1qf375566DKv.csCryptographic APIs: 'CreateDecryptor'
            Source: J7XIGd3DCJ.exe, v30YUPM1qf375566DKv.csCryptographic APIs: 'CreateDecryptor'
            Source: classification engineClassification label: mal100.troj.evad.winEXE@21/20@0/0
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeMutant created: \Sessions\1\BaseNamedObjects\Local\bd733e4f4e92be868fe2665f1e8b914caf1399e0
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Users\user\AppData\Local\Temp\LBD9ZEOrYTJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat"
            Source: J7XIGd3DCJ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: J7XIGd3DCJ.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: J7XIGd3DCJ.exeReversingLabs: Detection: 87%
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile read: C:\Users\user\Desktop\J7XIGd3DCJ.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\J7XIGd3DCJ.exe "C:\Users\user\Desktop\J7XIGd3DCJ.exe"
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\Registry.exe'" /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\Registry.exe'" /rl HIGHEST /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\Registry.exe'" /rl HIGHEST /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsX" /sc ONLOGON /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 13 /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsX" /sc ONLOGON /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
            Source: unknownProcess created: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
            Source: unknownProcess created: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
            Source: unknownProcess created: C:\Recovery\Registry.exe C:\Recovery\Registry.exe
            Source: unknownProcess created: C:\Recovery\Registry.exe C:\Recovery\Registry.exe
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe"
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat" Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe" Jump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: dlnashext.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: wpdshext.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: version.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: version.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: version.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: version.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Recovery\Registry.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
            Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: logoncli.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: ntdsapi.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\w32tm.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: mscoree.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: apphelp.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: kernel.appcore.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: version.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: uxtheme.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: windows.storage.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: wldp.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: profapi.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: cryptsp.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: rsaenh.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: cryptbase.dll
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeSection loaded: sspicli.dll
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: J7XIGd3DCJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: J7XIGd3DCJ.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
            Source: J7XIGd3DCJ.exeStatic file information: File size 1550848 > 1048576
            Source: J7XIGd3DCJ.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x177000
            Source: J7XIGd3DCJ.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

            Data Obfuscation

            barindex
            .NET source code contains method to dynamically call methods (often used by packers)
            Source: J7XIGd3DCJ.exe, v30YUPM1qf375566DKv.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
            .NET source code contains potential unpacker
            Source: J7XIGd3DCJ.exe, yHnR9w3kZGJYoHS26u4.cs.Net Code: jSGWUGH7ca System.AppDomain.Load(byte[])
            Source: J7XIGd3DCJ.exe, yHnR9w3kZGJYoHS26u4.cs.Net Code: jSGWUGH7ca System.Reflection.Assembly.Load(byte[])
            Source: J7XIGd3DCJ.exe, yHnR9w3kZGJYoHS26u4.cs.Net Code: jSGWUGH7ca
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8B2C38 pushad ; retf 0_2_00007FFD9B8B2C41
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeCode function: 0_2_00007FFD9B8B2C28 pushad ; retf 0_2_00007FFD9B8B2C41
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeCode function: 13_2_00007FFD9B8A2C18 pushad ; retf 13_2_00007FFD9B8A2C41
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeCode function: 13_2_00007FFD9B8A2C38 pushad ; retf 13_2_00007FFD9B8A2C41
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeCode function: 13_2_00007FFD9B8A2C28 pushad ; retf 13_2_00007FFD9B8A2C41
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeCode function: 14_2_00007FFD9B8B2C0D pushad ; retf 14_2_00007FFD9B8B2C41
            Source: C:\Recovery\Registry.exeCode function: 15_2_00007FFD9B882C18 pushad ; retf 15_2_00007FFD9B882C41
            Source: C:\Recovery\Registry.exeCode function: 15_2_00007FFD9B882C38 pushad ; retf 15_2_00007FFD9B882C41
            Source: C:\Recovery\Registry.exeCode function: 15_2_00007FFD9B882C28 pushad ; retf 15_2_00007FFD9B882C41
            Source: C:\Recovery\Registry.exeCode function: 16_2_00007FFD9B872C18 pushad ; retf 16_2_00007FFD9B872C41
            Source: C:\Recovery\Registry.exeCode function: 16_2_00007FFD9B872C38 pushad ; retf 16_2_00007FFD9B872C41
            Source: C:\Recovery\Registry.exeCode function: 16_2_00007FFD9B872C28 pushad ; retf 16_2_00007FFD9B872C41
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeCode function: 20_2_00007FFD9B8A2C0D pushad ; retf 20_2_00007FFD9B8A2C41
            Source: J7XIGd3DCJ.exeStatic PE information: section name: .text entropy: 7.268458842101928
            Source: Registry.exe.0.drStatic PE information: section name: .text entropy: 7.268458842101928
            Source: BfsBBmsxHEOpauZphVFNsX.exe.0.drStatic PE information: section name: .text entropy: 7.268458842101928
            Source: BfsBBmsxHEOpauZphVFNsX.exe0.0.drStatic PE information: section name: .text entropy: 7.268458842101928
            Source: RCX43F5.tmp.0.drStatic PE information: section name: .text entropy: 7.268458842101928
            Source: J7XIGd3DCJ.exe, E572HqJoMMSnMQPDKuA.csHigh entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'lWpXeWuvxVKhhXAFhS0', 'kkwlx6uoSY7oDyIangP', 'LmAZd9uLugZDytY1KIH', 'YLZE1Xu6LWP75ydoTf8', 'Ls9VnyurtPoU2kfeWpO', 'd2BLhZuGGCn9vHmWMdr'
            Source: J7XIGd3DCJ.exe, ztFDGt9hgqcJUvy1gYm.csHigh entropy of concatenated method names: 'JoNR7HaJsE', 'umQRAJpknI', 'hQ3RBytC1P', 'pUFRcaIreY', 'NLjRM054IK', 'wC1RbTPfoy', 'G7cRGNTfT3', 'D8YRXrBqJj', 'mE4RfJBUPI', 'mcXRNRBUf8'
            Source: J7XIGd3DCJ.exe, sD6Zpy9mBRRR64BmBGI.csHigh entropy of concatenated method names: 'WfALyqrWam', 'FjgL1CoAGp', 'b0pLYuLQxX', 'HXJrKmqJsd4D0yidM4Y', 'WyZQrhqfCkwWdpaXaZ3', 'cSJgxQqshIlHVEWViKE', 'uEh2T6qd5o8WaPv1ed0', 'VLptHpq38kTyYQA3rxk', 'fM1n4Iq2Xv3eYe7ju3S', 'egNn0wqgfEvWDWrbR8G'
            Source: J7XIGd3DCJ.exe, bVLpp3JiVNdZmhPCniy.csHigh entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'vT3dLuuEivDheeH3bYo', 'Ndv0dWu7v6XpuZ6sngg', 'en0guGuBKR1d8hp4bwk', 'pfLU0iu0isOq8F3u2VJ', 'bSJC3euVn3jRwBK3aVu', 'RtsVPGuWBloJbXwnBK0'
            Source: J7XIGd3DCJ.exe, zENcBeJpTmxsroIxJkf.csHigh entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'G6SwkbNm1DTMla70cCJ', 'WvqL3TNAgDIDh4tu7Ur', 'EFQ7tJNqCbp1J03VPkV', 'tS26fWNfLmB0KrLl43S', 'eQPCWNNs40QnIBPeZe1', 'jRlwE9NJSBdWZ0ddZtG'
            Source: J7XIGd3DCJ.exe, t15ga0w7Vd39vSUlEkk.csHigh entropy of concatenated method names: 'sg9', 'jZjkiA7LqJ', 'jecbgrUrLX', 'MPQktA0X04', 'U9WNk9r9W20XE4KesiJ', 'Y16Dx2r18EUSjlemTFm', 'hFrMxWrY6DKbjMAoAuI', 'zI2ZNvrUPWXNQwXqa6l', 'rCdh0prZUM6biVJY81F', 'WVoEjmrQJdExBAkTX1w'
            Source: J7XIGd3DCJ.exe, gSr08KaUFmX6wlwdrfY.csHigh entropy of concatenated method names: 'ASmVjxPmAH', 'e38A2r2ClHVr6FgbFPW', 'mwCa2T2jlt0hV2CWKek', 'GSQ1vK2pVnDRiggpiNZ', 'SYEMV82kjcEtxZxrq0r', '_1fi', 'VGkmeGPa4d', '_676', 'IG9', 'mdP'
            Source: J7XIGd3DCJ.exe, jKQUL4J8nvvuV2JqGvy.csHigh entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'CQdYFTDlcRdEj5PsH6a', 'uBUmXQD5vhFZdXwYQg9', 'EK7yqhDSSs0Nm1UVT7y', 'DhjgSuDmh1ubtxQGHF8', 'ddp9M5DAaI3TpibPL0J', 'ARMYccDqCjtKKxEVnPg'
            Source: J7XIGd3DCJ.exe, rWT06i3XlWJvS163X9E.csHigh entropy of concatenated method names: 'wyUAK5gDlL', 'cf7Y3giW98RNMpkIxRL', 'lc2RYliPfwHuA0GhtF6', 'U0WLvji0NM7Jg9TPRXH', 'ncamMgiVcY1BIEcnAtE', 'Es0rcaizINsW8Y1rmnQ', 'Ttbp2GwtvUnkAo8jJa3', 'Xeeve7wxt7NC2MHUdSU', 'ga1dV9wc1IYZjZ6PS1Z', 'H9k6SdwK1G1ZwOFqTt5'
            Source: J7XIGd3DCJ.exe, xaMhBP3c1UMoL8PCaND.csHigh entropy of concatenated method names: 'D00Wg2JKTx', 'YyGWnYRYFt', 'U5NfboMv18Pai8IoZbX', 'zCmSJdMoilaaOfnOjOZ', 'aGGTxMML5lfmWb9k2Bd', 'dB6ZmqM65sWTAaSSgPT', 'i3cv1aMrcfC4Lhy45mK', 'D9RWwKMGKuI9DaUGEqn', 'gDAFIQMIZqQDHfXtt3t', 'WTaPj0MabgQyLZnwvac'
            Source: J7XIGd3DCJ.exe, pCXLdSwitI894eOQ41H.csHigh entropy of concatenated method names: 'B34M18lR9y', 'GoWMYuDy6o', 'oy1MegCoyv', 'BiVgsYLUTFlyXlNBp2P', 'mitKUSLZrQNm4NcUbDN', 'LbqX1XL9UbOGKuTZSt2', 'FZXLUPL1kNk75gwXCm5', 'QraIJqLYDMtruecBe4f', 'd9laKxLQJAZrFfGTXuF', 'fIuq7kLEAHsZ2OprxfY'
            Source: J7XIGd3DCJ.exe, fSSK7LaIFtFq5SxA125.csHigh entropy of concatenated method names: 'o63KDkSabe', '_1kO', '_9v4', '_294', 'cbVKuTeqZN', 'euj', 'vwCKLZfVNy', 'AmwKRXouUS', 'o87', 'uyhK6JIMXY'
            Source: J7XIGd3DCJ.exe, Rhwsob9DUE2OsCJYf7l.csHigh entropy of concatenated method names: 'ThHRmD7xj3', 'CByRVp94Rh', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'cnXRKlYDBw', '_5f9', 'A6Y'
            Source: J7XIGd3DCJ.exe, N5O59O3FmIWqXj3nSlq.csHigh entropy of concatenated method names: 'sQtW3DlGQq', 'boqtQOMK84P11KYmykU', 'kPbgBHMHJQnpRqYjdBU', 'tTVje0Mxeytwbc2WPKM', 'usAJVOMc3r82g358smj', 'S0j25fMTwkef6cosw8O', 'pDndugMe7wB4Ir7foOl', 'bnyOWiMunYIqtqDpXxo', 'Rctt1jMNYvBfypMmhZV', 'OUNUyIMFB9GoZVrSu46'
            Source: J7XIGd3DCJ.exe, poxdqYwzA89oeZHE7DC.csHigh entropy of concatenated method names: 'HmNGmpfBNQ', 'kMRGVY8ylW', 'tFQGKUpH5T', 'gwFPGrIdQf5jvuMNsxi', 'CqYgkXI373H8pZjrRCl', 'bLgZYHIsnOmESGUkiV9', 'sQdMZKIJaHYFSbx9AQ7', 'UkMhaVI2RYmbYVXMt9o', 'pZ0IydIg02DNG9UIfHd', 'LcgWJRIUjDsafbVeLCa'
            Source: J7XIGd3DCJ.exe, wVApycwtTnBUf0ekhb2.csHigh entropy of concatenated method names: 'JfkU6oIqjom6QbKgOJH', 'oi9PxbIf1wNhSRNhmeS', 'ospYXXIm4QBL5xk9wjf', 'tTVKDBIAKJSJdx5wZ9x', 'IWF', 'j72', 'cURGvCEoS8', 'AXkGOOyjwv', 'j4z', 's9GGxybQaj'
            Source: J7XIGd3DCJ.exe, EEQUyFHkwoxwidlDB8K.csHigh entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
            Source: J7XIGd3DCJ.exe, KNWECIw8T1RaeZkFpsv.csHigh entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'vaGGXEHJKi', 'MyqkNK54Ym', 'QqKGf3ZFuB', 'S6SkC1q8aI', 'QuZZpGGf5lRMq6uXEiX', 'FZY3sXGsEOkDAQWQdPO', 'Ck9PtwGAyWq92ESGlRM'
            Source: J7XIGd3DCJ.exe, wE841QaRoECuJY66SAv.csHigh entropy of concatenated method names: 'PJ1', 'jo3', 'q2bKb8YCVs', 'VDQKGs0si0', 'KAoKXGmwM9', 'EC9', '_74a', '_8pl', '_27D', '_524'
            Source: J7XIGd3DCJ.exe, rlodgVwfXWjo2niuwEG.csHigh entropy of concatenated method names: 'lGhbk2PE7M', 'EfqboH4ivu', 'uyM0porX810jFSvxBMe', 'mxubr0rvL740xyGU91Y', 'YrCxpari8dCSoYWmwy8', 'vGOU2TrwqNA3mKr3KP9', 'sLiRWXroyYIlc7wMsjw', 'TRHySLrLUnBaFyaBxqQ'
            Source: J7XIGd3DCJ.exe, FeY8LFuXgd8VHT9Ha3.csHigh entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'ktQ8n2BVp', 't9OvSscvntRGjq7sMlN', 'oVoGajcogoe4XA0WtRS', 'ls21khcLd4QDVp4lVQH', 'vJi2Gcc6Y6FJvcyV1Nu', 'JP09Dacr81ZU3khu7vI'
            Source: J7XIGd3DCJ.exe, c8SIuWHVjjeTHq1vDdJ.csHigh entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
            Source: J7XIGd3DCJ.exe, Fv1touH9j3uYwT9jQj4.csHigh entropy of concatenated method names: 'KJhfv0hVj8', 't15HBcaXv8b1Y129LJZ', 'uwLyDGavFJOYCj0NU2R', 'fndmEXaiVi7ACHIyDrS', 'iGb0Qhaw5aI8DxJPMfH', 'D5OGwHegkN', 'CQrGFbZ8LK', 'kOhGkLtMPd', 'hjWGoZisYm', 'jhjGhjVt9E'
            Source: J7XIGd3DCJ.exe, n54cS79kTpjrZaUI23k.csHigh entropy of concatenated method names: 'aftL25gdEg', 'D2MLJQf4dK', 'fkPmY8A7B9KXP4IspH1', 'xRuEAIABrmvANSW4Ta7', 'spjokCA0S0pD22RIlEr', 'JXfrdtAV6Eh2Ee31BYh', 'XO27S4AWTikm4ujqk5H', 'yyk1SAAPsjEv0ofpb9o', 'GPCdejAz2iMPhkSfylJ', 'F5WMyRqtasCSGrcfwDw'
            Source: J7XIGd3DCJ.exe, IQhuAgTeNe5n4UK0Sj.csHigh entropy of concatenated method names: 'H7HLJCZqb', 'MyqRK54Ym', 'S6S61q8aI', 'PnyZ17KjA', 'PphmlceRH', 'RosVu36a4', 'AtDK43DXE', 'f6BYfNxNl7YMstyrNue', 'bvcRBexFUPy5vuVVZoV', 'nQAE8vxhOr7EnMHjpuF'
            Source: J7XIGd3DCJ.exe, M8VTepMOu5E792KEbp2.csHigh entropy of concatenated method names: 'KLFFLR9vWq', 'WjNFRjPCJ4', 'YRoF6C22mP', 'OkdFZceZhT', 'D7jFmAuPex', 'sdtFVmLblL', 'eTlFKs20YI', 'KdvFw0v0pI', 'pEWFFhWdN2', 'IFJFkkw7XH'
            Source: J7XIGd3DCJ.exe, N5p9draOeLRSdECImPI.csHigh entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
            Source: J7XIGd3DCJ.exe, OEpd6jaxdXmgkG9Lcct.csHigh entropy of concatenated method names: 'AO339k2HOrUCRPFm6wI', 'Xsb9wP2TyfxFAN9gm5o', 'K5CquI2criZbBmOd58G', 'zYIa5L2KMFsmFvOiPLZ', 'zcKZhNyetb', 'WM4', '_499', 'Ds7ZP0P524', 'J7aZH55Mj9', 'FJkZjAYFaq'
            Source: J7XIGd3DCJ.exe, TCb0dA9wq99imirKQqA.csHigh entropy of concatenated method names: 'GODedW5rhbOwSoVNX4A', 'td7JtU5GlEEoqkL3ipa', 'P8Gc725LNiQXMQTNQhu', 'TaP0t156Ho4tiaHTLCA', 'tbd2LQphMv', 'Y4aW2E5OACOP8ZyPdaU', 'SbygGQ5Rj6bmaBSHF6b', 'G6HFSQ5IaLdotBy3IRH', 'vMq0aW5aJfiVbXlYYTS', 'CM3oCV5pkLhvbqAbo86'
            Source: J7XIGd3DCJ.exe, tbHCrJJ4u9GdMOdMlr7.csHigh entropy of concatenated method names: 'TtTtXnfhMf', 'ONQtfF3XOn', 'rJbrwDDbM7nf9etKj7U', 'xlYpvsDh1OswYZ07ua3', 'bKvbCMDDUQypgrlUvYg', 'qbd21HD4n3IWIYNNpQs', 'By2sFmD8CXfZ5JsBXf1', 'kwh1P1DMaXaSsEmHh4U', 'ia5AOcDn33RCZGtbQbU', 'lZ7ZC6DypM2iUBil2UM'
            Source: J7XIGd3DCJ.exe, CAklpi9L429jWqslo9o.csHigh entropy of concatenated method names: 'h4kLqu2wb1', 'bysLIdMY1s', 'R0wL0na01C', 'xU0L3WKym7', 'f3TL4o1Mlm', 'VtZLgBsiTK', 'ee5frrq9pN0XwrpDult', 'XaC4HwqUGICvrmQk2FN', 'yEgwgRqZ4IaOSDl85fX', 'ykQEVUq1K6XTrmUOTGv'
            Source: J7XIGd3DCJ.exe, gxnSsa4h7dkEaoPDjQ.csHigh entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'tl5EfrH2G8ShG5w4FJi', 'hU0RWcHgVJ4HYRlqHUA', 'DgmJFIHUNDoNaPBmCaC', 'QjLR5kHZFCQsh5HvGoH', 'kiv8gtH968I6d1X0eL9', 'OO4kH0H1Ol5tfTsnDpH'
            Source: J7XIGd3DCJ.exe, k3NpVPwHZw54QfckWPu.csHigh entropy of concatenated method names: 'zFkca7Pvow', 'URqcTSfHJN', 'o1Hc5JE9S4', 'cjycQ8YDQZ', 'aqnc9v6O6L', 'vWdcySHlcG', 'SPjim5vknDHyUndh8Ul', 'qDsagYvRUi9o89snaL2', 'pRwfIevpQxlTN580THc', 'jOitWsvCkVai529BZrN'
            Source: J7XIGd3DCJ.exe, JiJwnuwvpiyaEm7QR3y.csHigh entropy of concatenated method names: '_223', 'TB395ALw4gRIttO9vIG', 'U9JlboLXrdXhySCDRhv', 'xJTF9MLvaMSrA2R62fV', 'O8GP0dLotD6MOU0tYWI', 'KFRuB0LLXHHkkibdVIR', 'mWTUUEL6HH0iZOwgURg', 'FP2TXmLrsgqaaDFIC3O', 'wi6rgKLGTfhbMCh0H3L', 'Fc77yuLIxHaG0KHVga4'
            Source: J7XIGd3DCJ.exe, GUP8Bq33u0WYAm8Ejr8.csHigh entropy of concatenated method names: 'xtWtyynvd2', 'ykBt1gBUiF', 'UMdtYo0ej5', 'SdTte8Pins', 'Y95tqBxyPv', 'TYMtIFhWB1', 'E12Gbj4wd3MVZBwM1sI', 'EpcFAo4XTgnRlGndwxv', 'w4RlG44y20X2cNDrPUp', 'A5XIYG4iKTWvqtXjZxO'
            Source: J7XIGd3DCJ.exe, UxxtbVHIHmQDApMkqbC.csHigh entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'r7PUEis3XI', 'dhrUsGZP3P', 'r8j', 'LS1', '_55S'
            Source: J7XIGd3DCJ.exe, C9gKES3AOhmSleLBnbk.csHigh entropy of concatenated method names: 'yJwBMyshSr', 'MerBby6F8H', 'lfrIScwB3pNAB8IUKmg', 'ryutnow06aMkFEtwmkH', 'WipYCNwESye2pul4Ujs', 'cQVOZaw71p2g28IqHFu', 'WXxBvpXSvV', 'x0Qo3XXtY6BWcokPAw7', 'EyKDmGXxkbYgbwgoT83', 'XFdvKcwPRFeXpy1KBCh'
            Source: J7XIGd3DCJ.exe, IPNwZOJFucZHFy3XxK8.csHigh entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'xZ65Uqustd31JZDyLKK', 'boQvyruJEGmmdNl4spq', 'aTtNj7udePredBvWdwn', 'Xv0hXXu3OkloEZsfPE6', 'qMkiRBu2BKS3UkXXOoZ', 'kwwxLiug9SnR78KiYiH'
            Source: J7XIGd3DCJ.exe, x9Zjt33g7BJT6BeFpQ2.csHigh entropy of concatenated method names: 'YGtWziWyns', 'sgE7dcLa1L', 'FJi7iWh3ja', 'wrR7tnbMxX', 'yUo7WEKgOv', 'gYn77Y3Iht', 'caq7AurYHC', 'Iej7B7L8w8', 'KDt7cbNPNK', 'CWB7MVwRYp'
            Source: J7XIGd3DCJ.exe, R6woktap0dDUU8ApJMr.csHigh entropy of concatenated method names: 'IGD', 'CV5', 'jyE6LivSh8', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
            Source: J7XIGd3DCJ.exe, y7gcVBJtbJ8nVpudbf8.csHigh entropy of concatenated method names: 'qhwtpUS6bQ', 'LqbUI3beNlpPDovNQlX', 'ryVCGfbuhPeAEWy4IED', 'zEhf2CbHYM7UPlFC4Ip', 'gsx6G7bTk8affqSS30g', 'BGBvYfbNYHga7Rolfe8', '_5q7', 'YZ8', '_6kf', 'G9C'
            Source: J7XIGd3DCJ.exe, Ys4EEQ9CEcRBRdXx0vx.csHigh entropy of concatenated method names: 'ugdLSq5igG', 'MI8L8Wv88r', 'ANuLrZUGgj', 'ktDLamxnHn', 'IhhLTQrcsW', 'b4NBOPqpG6K3WIR27iu', 'Vku5qTqOMuh7QMRhWgm', 'sxxqPAqR5ceinHL1xNo', 'PS4hneqkM9lKiAN3YWe', 'vmYVcnqCSA8bIlSVJtU'
            Source: J7XIGd3DCJ.exe, mqdd2VVD46Md8DQvbm.csHigh entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'PV8ga9T7XoboKkrYfDd', 'AKxQOFTB03SGlPdp1dy', 'anw1HCT0aPwO2v8pYF1', 'mlUYYGTV9EkBYD7EnaC', 'y0sUCMTWD14tiEfQUmR', 'Hmb0enTPPfpOUckeq3K'
            Source: J7XIGd3DCJ.exe, wtWndUwyQxRClXMWKgs.csHigh entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'G1D3Phr83CddPTDy7ov', 'D4yloWrMWjMHy0J41HX', 'i62maHrnjds0f3vCYd7', 'KeNIcNryH7pCrk5JGAe'
            Source: J7XIGd3DCJ.exe, lowIdHHtbAoTgYH4Vtp.csHigh entropy of concatenated method names: 'V6NERZdRkP', 'jSKEZt6Jaf', 'iiTECl7CBM', 'DBJEUZs2re', 'wVmEEhRjqF', 'q1FEs2D6Eb', 'OdXEv8U0qd', 'PKkEOuafew', 'kaUExGXfcx', 'o22EpDK8OB'
            Source: J7XIGd3DCJ.exe, SQbtdjayYx5CuY7DnVd.csHigh entropy of concatenated method names: 'bbM62qtIQx', 'wlK6JCLJNI', 'KE86lIFuNK', 'Eyc6DbmjVs', 'rv76uM7Hko', 'SMAIGMJVr2Gw7Itt9R4', 'vLhNbrJWbO6oALUSUOK', 'PikWI1JPBexLy4hIwmA', 'G1S3a8JzFE0D9kXZ0Qj', 'EUA7PFdthyH2qFq32lG'
            Source: J7XIGd3DCJ.exe, LIjxgK8k1Qb6sECJ3d.csHigh entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'VsnWXJTnurLbpLkE1wd', 'zKyrqoTy1HJXXmmQq92', 'Guy47ZTiGT5NcSdMD0D', 'DtUnuhTwhBhnuthPBl6', 'A1KhJNTXZhIMbDTynEY', 'B1reFSTv8wpyQR18Hnf'
            Source: J7XIGd3DCJ.exe, ieBjimJvfqPSqjTGBT7.csHigh entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'PEsMpuuRc7OKQyeoWo7', 'uN6O5mupMHwi65RWGFI', 'R7PkmpukjJQ2ocbtKNs', 'Tl6fQouCQQekjCYejHd', 'qBw9HXujClACKuNonFO', 'L1OYOful8irbNh639Ql'
            Source: J7XIGd3DCJ.exe, i6RARFwr30gJHuFtMBd.csHigh entropy of concatenated method names: 'PYAbEN7rL5', 'guSbsfZ1si', 'haSbvvOLhE', 'IQIkPw62nlaoKCSuG2U', 'eRVFRm6dxhnRrhnBMBN', 'svndiZ63ALY9yWMLbnV', 't1QVAT6gVokMFKyQAhT', 'mqybB15hmU', 'BuNbc4qSTS', 'qFjbMStktp'
            Source: J7XIGd3DCJ.exe, g20gCyaNN52MPVk100e.csHigh entropy of concatenated method names: 'EV6RQWBZwi', 'Sx5R9duuvF', 'J3FRyeQO6o', 'nUvR14CCNl', 'RrnRYy4US7', 'ts8RexvOnw', '_838', 'vVb', 'g24', '_9oL'
            Source: J7XIGd3DCJ.exe, yvyk4GMoZn2JigTcef0.csHigh entropy of concatenated method names: 'V91bnRGGbcv3V', 'ykvLLOUnCJFWRmtxBpD', 'JuX2lYUyY0xqOMrqbAB', 'gnp8oiUiBrvV92bLjXs', 'fbXG9bUwoVi67P8RNuY', 'qCMJpNUXRnUhIMx3vOG', 'XiM2ZnU8a0fJ00vJkVN', 'pCaONiUMwESIFULhJvn', 'OWd9dpUvueeNwgNgH2F', 'BR2rYdUoQdjKXZAXxP3'
            Source: J7XIGd3DCJ.exe, g2AqOIHT7i8be3Jsely.csHigh entropy of concatenated method names: 'PSx4sROgTFWcjumtfSh', 'hUCNXiOUvqtlbVaf74C', 'yGLIC8OZ8cNEtdGkGgB', 'poXZiEO3lBVDw5yn7b6', 'JoAC9LO2VeuOv2uS1YK'
            Source: J7XIGd3DCJ.exe, HGK69a3n4PXgNembfiK.csHigh entropy of concatenated method names: 'zMZ7gwahTo', 'HXk7nr8oA8', 'pVZ7zxOYFR', 'nw1AdNcJnu', 'vIyAiGLuTU', 'yPqAtdVH8a', 't5IAWHmuBb', 'TpNA7GdNqT', 'hoEAAS2cLh', 'wtNtncyBHR1H9GKKolr'
            Source: J7XIGd3DCJ.exe, e2pZMM3bNnH182XI9iO.csHigh entropy of concatenated method names: 'DW97CFKbbO', 'wJg7Ung6Ou', 'px66uBnIRSvODNu4MV8', 'LSnaWwnakH3HlBIaQSd', 'zEiOZlnrqvlUvVEZypC', 'qhb1jVnGJDTI1BcO5Oe', 'HOLg3bnOBm17ZZKWe4w', 'W9JwNfnREZleg1iWAcK', 'FABOkFnpoPPfWIj1dUI', 'CdHnRrnkekT9l8fOwox'
            Source: J7XIGd3DCJ.exe, HTLnomJsyI6sSNZbr95.csHigh entropy of concatenated method names: 'hRMiglDcU0', 'Awr1w9hqITtNrw97xAg', 'U9W0sOhfy8P48nHXAFV', 'U8Af0Jhm2XWWq9nuUAc', 'qqknwdhAndJNbG5T0ag', 'coTirWhs5AkeggxmqhT', '_3Xh', 'YZ8', '_123', 'G9C'
            Source: J7XIGd3DCJ.exe, W4nFCc9EFrpUcWscUZk.csHigh entropy of concatenated method names: 'k8HaSkfTVDwXF9y3JUe', 'BYcQ4WfehE9K6MPBhFG', 'O4wVnIfKLrG0D1C1lY3', 'aRuE7OfHqmobYOUtgsM', 'trG5Ylfu1afp80ihAEL', 'ICdnqhfNjgybR1BHc96', 'zfdv3WfF1qaaqptex0v'
            Source: J7XIGd3DCJ.exe, AYAlbiSAcvK3lLP7WN.csHigh entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'uR50KmcDkHvUZinIt6Y', 'QlAj1Xcb4uH7gsLDgvc', 'rZJrL2c4QWO1ZTblOd8', 'OPRfHqc869pV2NM30kd', 'nMRx2OcMvmf5vY7cHAL', 'G7VRj6cnwQ8TUejvSTd'
            Source: J7XIGd3DCJ.exe, CRYWkK3Do9E38ES7CLJ.csHigh entropy of concatenated method names: 'BePcRTfGmF', 'khPLOvXYTWOkMBHoiMp', 'bk2L1hX95I3VAB7mSDE', 'uesTvBX1W17esB6vdUA', 'gmFFp0XQdAhFsSaLJ6E', 'TTKd0pXELYqT4hgWmkZ', 'Mclcx4se9n', 'uudcpOTi8W', 'apDc2dUvkG', 'wtwcJ8wQ5s'
            Source: J7XIGd3DCJ.exe, Cg9uGsRbI7JojAVSs1.csHigh entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'SkGDhRHw4Y8oFsc6725', 'KiVufsHXHSJrh6ByChu', 'OewrtpHv57oA2RwLAKp', 'zlnr92Ho2xFV7U3OsJG', 'qp2OU2HLiwGL7vqyBQy', 'x2b5FoH6AirFNG6OTqu'
            Source: J7XIGd3DCJ.exe, qRmNwxJnRAPhFifmZJL.csHigh entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'S7GurIFAq8h6s3dyMjG', 'vgTGC6Fq4jRx6Llts73', 'PycTnYFf5IuwnjoLY9y', 'kI8AV4FseAvwmYRBlY4', 'ChAIQoFJn0JQKtFPZ4H', 'l4IfURFdyCh3DPMFghV'
            Source: J7XIGd3DCJ.exe, RGUm8iw2p5HDpHQUtau.csHigh entropy of concatenated method names: 'UvfMqmvPEy', 'VNpMIONHgm', 'TigM07E9XW', 'uaCM3pcSdJ', 'OLVM46xr2X', 'KGvkLI6eABcpKXK7BDi', 'JAXgcG6u6ZbqD1G3aRn', 'NIv6cc6HWBRaAosCCbK', 'dyp1hT6TRTVn0IGUhSV', 'J75qdT6NIINZO88yTOB'
            Source: J7XIGd3DCJ.exe, F0j9vAxY5uYtfD2q0F.csHigh entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'fRVTfSgEm', 'yf3uk2cmM0mGUVAQ8dk', 'JUMRetcACPl71eAAHXm', 's9hYficqMfO6Rt6XYbv', 'jh0rvbcfcIGGf02CUkZ', 'rUAMNNcsH9GUSkq2aYt'
            Source: J7XIGd3DCJ.exe, sg0GZxHfY7DMp48Y8Bb.csHigh entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'TvsCd7hNrj', '_3il', 'PpgCid85Ps', 'TqcCtyWKfk', '_78N', 'z3K'
            Source: J7XIGd3DCJ.exe, lowETy9Kx0ERTak9KJ5.csHigh entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'nvHRuNU8u5', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
            Source: J7XIGd3DCJ.exe, oVh9E7HcjL1pehLEkSi.csHigh entropy of concatenated method names: 'gbFN7XrIRH', 'OZENA0uibT', 'YATNBVjpdS', 'lRo96COiWTi6Ko1gC7T', 'oM1Bi1Owhmvr2Ny31KH', 'MawQI5On6daVDy1hbYa', 'LWQZWROy9D19JiTeYve', 'MPocECOXOsQBgpVEJpB', 'W5QpiWOvMeQy6kyV3IR', 'wH93itOo6uTuMZ195J5'
            Source: J7XIGd3DCJ.exe, judf43a3ULbgIgRFKgP.csHigh entropy of concatenated method names: 'Lpe6MAT5YC', 'hGT6bHEMfh', '_8r1', 'B3l6G0WNLS', 'u8O6X7CRAT', 'p4e6focNa6', 'MmQ6NI2Q7R', 'JZRN3HJygJMHVkWrmqd', 'G7d2PBJiJvOEKMhDuZm', 'cksF3TJwaqDngZrtc11'
            Source: J7XIGd3DCJ.exe, NR1dk7JD2ukEtRgFRlW.csHigh entropy of concatenated method names: 'C4StDlFWrJ', 'EO6tuWiAHW', 'ed1tLGC48O', 'BJLBHwbDsCM0dVEtiBm', 'FqCrTtbFyrw3HjBht9i', 'NatsxEbh6uM6jX0emOM', 'bEF5NVbbiee2F41IFfT', 'J9RVYob4jpP9Jydan1f', 'RjTgh3b8HtaWx2VOHF3', 'cVKjnybMnKunW1KV8Dw'
            Source: J7XIGd3DCJ.exe, bEtGbtHoUV3FfG5he5O.csHigh entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
            Source: J7XIGd3DCJ.exe, aWN8muJ9ki0bQB6xHul.csHigh entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'ns8M7MeUqwhMPRa69uW', 'Svn9F9eZSUeWtQGTT4V', 'XjGmKTe9m0sAhfqPARO', 'Cw3YJKe1nWUFVl02EtF', 'zB9xhxeYPP08Qrd7SG9', 'lgQqjZeQusvi7TAxy3h'
            Source: J7XIGd3DCJ.exe, fR7HoaHgeigVhmc9sQj.csHigh entropy of concatenated method names: '_7zt', 'Wg3NpFxfiZ', 'V5fN2fWx9h', 'SVGNJjo1u1', 'MX5Nl0fNnq', 'ewaNDKJuHS', 'A76NuubVtI', 'BmnfV1Oru75rng7RnGk', 'YoQIYQOGQLx7q01lOsY', 'AZjmgAOLId5bYdhlhX0'
            Source: J7XIGd3DCJ.exe, GQ5hw1w5FSruU1VyqIw.csHigh entropy of concatenated method names: 'BdHMoXkmne', 'plaMhnrFTu', 'aWFMP03AFQ', 'deDqByLM5yVkiwuqJAL', 'XoIy7mL44BptVOrRaLU', 'pHhObVL8rrk7KLFFZsw', 'NiNqIlLn9CxdPRD3UIE', 'IOUMEI38yq', 'irvMsgkxPa', 'h5mMvhDOxd'
            Source: J7XIGd3DCJ.exe, KgYwW6zDYHxNuWMqhN.csHigh entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'cqx8O3eKKt4yOyeLtXL', 'MHOKupeHiROgP3QuKhH', 'lU7VW2eTXcIUfsNSfTA', 'BQqwfOeeHg6CBkWOA1Q', 'Jh0pFyeusc1sph5U6Mt', 'm1yJX9eN9M6QX4ve2Mt'
            Source: J7XIGd3DCJ.exe, LtUbSDtGZNLosZuf1P.csHigh entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'h1jZB7TgwyOqjtiBhqL', 'Y9axxcTUrQAXw85j1Fy', 'JOwprhTZqOijbUQlg8m', 'KfPXAOT9OI02fXjbHu7', 'SElRgYT1ivxfuDD5wwN', 'TcdVIPTYuuPo9rOS4Jb'
            Source: J7XIGd3DCJ.exe, VxFvWHJCxMtRP8fLnmX.csHigh entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'JScuxHNP2WwPsXdPXOH', 'Fvj9BZNzNqY5ia3lUw3', 'dXX4FbFte0UV4f9ftkp', 'j8DSC4FxlTTtiGvL5Ua', 'apbx5BFcn4rK123qEaj', 'htieSOFKNVigWqFykN0'
            Source: J7XIGd3DCJ.exe, jg7DR5JmxEtpKSRiYrL.csHigh entropy of concatenated method names: 'VcHiQqgZqY', 'JjwYMPhcsZyaFEG211l', 'C02vCthKhAVRWZYaJmJ', 'cN2exkhtGNt8kynTrbB', 'qmvqpdhxIifqga8kUR3', 'PFlYtJhHRiimubsAA54', 'HfM7CthTerxvqFBvr1V', 'I3ZV4dheHDbHLtoGfdL', 'IuUiyyZNVf', 'kagGv4hFBSFRTI4dyUs'
            Source: J7XIGd3DCJ.exe, Hp5BbiaCghxjZD1MTEe.csHigh entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
            Source: J7XIGd3DCJ.exe, xZXKv1AZlVWEQ7RloO.csHigh entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'm3tCvqK0yfGPOvyFT94', 'LMHle4KVCLqrTSxj306', 'zc83RSKWAoxmF0fKRFp', 'd9rD9CKPDvaTnrRlCyU', 'lMuSgHKzQiWtIecCZhD', 'jX2r9HHtOFm8yVPTKDF'
            Source: J7XIGd3DCJ.exe, X05vueauWRhT54N7ubk.csHigh entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'PDNZRHQbWu', 'pn0Z6DL15b', 'Y3sZZe9WlL', 'M6IZmu2tuV', 'KwkZVsor1N', 'UeXZKCJ0X1', 'U3utBI3qCrauJZn1pAN'
            Source: J7XIGd3DCJ.exe, bvGug8HB2pw8sKUu3Qt.csHigh entropy of concatenated method names: 'YEsNopSY2b', 'LvPNhb8qE9', 'UCANProFYP', 'q9SNHkHlWi', 'hqyNjiAftI', 'M8J7tPOmdptrJbccogP', 'yhFiPAOAigkgyFMDMNU', 'dZPnLiO5W8DFSqCAJQ2', 'O0wruROSDfwcjEAGnPn', 'iWlZ4xOqPUpF6E2KZsS'
            Source: J7XIGd3DCJ.exe, lYdf3TJXPgYBRvtsggq.csHigh entropy of concatenated method names: 'jstiIS0RkO', 'qB6ZpnhIfS9iscdUHlm', 'xWsBimha70ocdVFqM17', 'iS9WnDhre87lEtQOnCc', 'Ta25OFhGHFyVtBsJcAw', 'NDagSJhOVNDwlktnLW3', 'QLw', 'YZ8', 'cC5', 'G9C'
            Source: J7XIGd3DCJ.exe, v0yyW2JwvXq9e4IYOi4.csHigh entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'XtviTeeCgVcVnwS1Jju', 'TwuU3Kej1jQDk02gGVW', 'q6oagbel20rD5NSZYsH', 'llQf2Me5IfK21pfKpYi', 'bsRgCueScPtTTk1uwYE', 'u4Dfhcem9qqhft6DvIS'
            Source: J7XIGd3DCJ.exe, pKKESnwZBuQ2Hg1b0tY.csHigh entropy of concatenated method names: '_9YY', '_57I', 'w51', 's53kGn44bc', '_168', 'KcYh01GaAcdEr76FK6W', 'KsMc4XGO6N15ELWIt1E', 'm6QNJ7GRtRSvsfqOqMm', 'OdHL2JGpAQHLfweb4oM', 'Ofj0ChGkOtKyMmcww79'
            Source: J7XIGd3DCJ.exe, cOBnNe3TMrf06QNEHdF.csHigh entropy of concatenated method names: 'yIg7JVHPt1', 'Vno7luDdnB', 'txN7DCV71D', 'e547ujQOcE', 'TOy7L4Am8V', 'piQ6pZytBLCNfwfawdL', 'FR44SHyxAuaIB1Hx0at', 'FJPCIFnPVDfeyDv5n6L', 'u2XcSanzWmd53EP5KSJ', 'lOXp7Vycy02dKmrKlVv'
            Source: J7XIGd3DCJ.exe, oqKypeH6WOHeE3cg2a9.csHigh entropy of concatenated method names: 'qQ3UggvcL5', 'WXbUhnjFWf', 'yy8UPArls3', 'vGZUHt4GAC', 'whBUjs8XOo', 'CSuUSu6ZHC', 'f3tU8CyRbe', 's0vUrTGBTm', 'Q2iUaG5LXQ', 'nhnUTxr64m'
            Source: J7XIGd3DCJ.exe, DDt9Sxstq9CZTROkPk.csHigh entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'cu6UEnKAOgYDl5myC0L', 'o5nqppKqnnDfg0ej9sR', 'e6MNGyKfiVv20TZHPKC', 'LPIMd1KsAybvWkuEIeo', 'rulW33KJZXwxur38PxI', 'PdcvCSKdJj5iCW02Z0Y'
            Source: J7XIGd3DCJ.exe, BeP2yZJZZLsnnNLSrDf.csHigh entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'hvLyuuDLYGGZdkJV80m', 'tviWNuD6EKB21m8VfKk', 'G3e0KTDro85cKbBjxAq', 'lU2KkVDGxi8yXJCSJ96', 'usgcZcDIr9a5jdu8MLs', 'Rp2bFRDaSXiyWlZFoPH'
            Source: J7XIGd3DCJ.exe, PYoZ6sJry62fFTVyweT.csHigh entropy of concatenated method names: 'Sp5iKTM5eu', 'F4CwqxNw51oMJZBWFTB', 'M9LARMNX0IJohSKyqhs', 'MmW9KqNyGgOTexVqg7Y', 'TYk7EeNiMUde2AufihR', 'M771nZNvaYQgN6KYwlG', 'emM6K8NoDytoTydSp81', 'IVj8JyNLc5kOLxKIddi', 'Gw7MxIN6I7loIob2HEL', 'f28'
            Source: J7XIGd3DCJ.exe, DKmqSg0tJbv1W5u2oE.csHigh entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'xhpkWpcWKOxkHMtypHB', 'wXvDKXcPT2AeUYsTM1T', 'IKNcrvczF0xXb9EJdaS', 'J1CMXjKtYpsOAbgA2yJ', 'smbLWNKxdKT5ao9Ruaj', 'yqm4hwKcVyLn1Im6FbC'
            Source: J7XIGd3DCJ.exe, gR2iLiJkavDUf7dYXO2.csHigh entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'J0vGkHuulefXonWDXEe', 'jk9UdMuNFWHHfTrRhnp', 'RBh98TuFljs0gHrN9qC', 'lBHKWHuhGyfwlQjGfWi', 'HyIuO0uD1h1rqkDjbyM', 'lhL7Ivub2lkN1s5Hj1j'
            Source: J7XIGd3DCJ.exe, vA0x7JMhXcGRSwE0i6.csHigh entropy of concatenated method names: 'zhsCaX3iW', 'zG4k9l5snJN7OQYNCk', 'HfAc1ujYKWr3bLIdlQ', 'FEg3K2lPmWs84YHOlE', 'hjjJmXSLYZkkByX6Dv', 'yv6q7VmF4diokFem2o', 'N41tcSIIg', 'WrVWCVTGg', 'zeb7dpuGq', 'QaiAOENmj'
            Source: J7XIGd3DCJ.exe, zi9RUn3NWHvbWnCVOGh.csHigh entropy of concatenated method names: 'BcJtRrQMA6', 'QOtt6IlZNL', 'wVYtZR90OT', 'u2xn9Lb5xrbUxA8boyp', 'fximdbbSPOQp2cwhd0m', 'AsjBTMbmd0b26tppepl', 'ggNeFsbAcKFcmQg3mhK', 'gwynflbqvaHvm37fbec', 'MldtZybf0Rt1hSR7CdP', 'sngK8RbjjyfAv0oA1Jg'
            Source: J7XIGd3DCJ.exe, LpseCIwF0g6kjFCXBTc.csHigh entropy of concatenated method names: 'rt9MTVVlXC', 'UGOM5v7rg0', 'cB2MQwwXTq', 'X6yM98M6Nc', 'i7bOf0LSULHg6v4favT', 'rxu8ttLmYiWOlXJkVyD', 'kSQGp5LAoWjQcfaM606', 'LyOvPeLl6m6B8QTUceE', 'TYAVKTL5VjYuPMqL31u', 'LhuVFeLq00CHid6QE1g'
            Source: J7XIGd3DCJ.exe, eMiJfeJOOseOwpTtXpe.csHigh entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'JPtutqNZkWa6OQ66o7f', 'G4F7ZyN9IGO5Z5U6doG', 'HycRUmN1r6xgxZo1cpZ', 'GON49xNYwYJqyMutFRJ', 'HFoqRyNQSZ34DmwEqT5', 'ucZwTZNEqZT0UCf10JN'
            Source: J7XIGd3DCJ.exe, uGsH4gJyxyVdS1qm3iD.csHigh entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'anYxLWNIxocasRifqb1', 'lUbyYhNauhSn3oI5AdJ', 'YXg6HhNOs3IQajZ8cmn', 'yN49vYNRAULpdEoscu2', 'aoDFUfNpmDQo5eR4ppA', 'tx4JyqNkS0l3iqK1ZAp'
            Source: J7XIGd3DCJ.exe, MZoV7M9jDVK8rP1wWBE.csHigh entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
            Source: J7XIGd3DCJ.exe, yHnR9w3kZGJYoHS26u4.csHigh entropy of concatenated method names: 'h5VWkDsRRh', 'hRUWoBa2eH', 'x6OWhBU4Q1', 'qb0WPQVET6', 'fYEWHrC6sW', 'PVjWjcg8vl', 'O0UWSkcH1d', 'zLyehd8IuumbS9vpxM5', 'qAYWbq8rA6YfcruGw64', 'B1VQyI8GrAyPvklYd9H'
            Source: J7XIGd3DCJ.exe, DVBCKhw6lbJB0hYw6DR.csHigh entropy of concatenated method names: '_269', '_5E7', 'PnykU17KjA', 'Mz8', 'Rosksu36a4', 's3OMVhGQeRvhXmSYD70', 'IulHcpGEp8nNDJ7EBql', 'GjUVFAG7JwlFvc81ban', 'lvvLRJGBFFjWRySmW0l', 'yjvHIoG05seCdAEv5o9'
            Source: J7XIGd3DCJ.exe, E3VgKJan6fQjXhrkNC5.csHigh entropy of concatenated method names: 'HZ5Zb4kvW1', 'OdPZGRNmbn', 'IjcZXwBkev', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'ylqZfmgpfE'
            Source: J7XIGd3DCJ.exe, Viwm2MHvRshPh9uTsXh.csHigh entropy of concatenated method names: 'b9DfPMqBf0', 'wtsfHTKTwS', 'eBlfjixPOn', 'xdXfSyK5Wv', 'kHNf8rSHRc', 'Vnk9KCaPI7ySc3KtNs0', 'HxmVH2az9D6pXB0MtJq', 'KWBBvFaVBoLSQi4RLM2', 'F8bApVaWVq3u6cNta5L', 'Od2P4bOtEnvxYYCF6yS'
            Source: J7XIGd3DCJ.exe, zdOth0JqaZZHkgAMt8K.csHigh entropy of concatenated method names: 'aQZtiiHJJb', 'gjttt9xW6y', 'akTtWd0haq', 'S7iwGyhQx6CUvYthe5F', 'a7IKHyhEImhE477X0Qw', 'NLgYSoh1pWctTG7BruG', 'TBuS5NhY4cRCEsBpvD6', 'jdftrbh7CZRKS8J9BrW', 'NHUUn7hBHyZrJHMcW3k', 'Oq9Ciqh0TlkxNgTQaUD'
            Source: J7XIGd3DCJ.exe, tRZO8DWNXHH1SwPS7y.csHigh entropy of concatenated method names: 'vhJhCIEOd', 'FLvPKgi64', 'nWIH1yfWc', 'LUOgKOxfdIhVDg85qdC', 'JormsLxAvM7CekEKZrt', 'zHb45NxqhIxGC4WWW6U', 'noGrRrxshfU2mJ2iuI3', 'pXcNyfxJWnInXJd6sdx', 'kJQ3OWxdsP9vJKG1CP9', 'AJrqXPx3TT9y0lnyUql'
            Source: J7XIGd3DCJ.exe, LkGsLpaaC40ksPUh8co.csHigh entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
            Source: J7XIGd3DCJ.exe, jGeXDD6wu6dmJDPSdY.csHigh entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'FIrFTjTpsdvCP4jWrWG', 'L5CuWuTkfGHZqsfHkaK', 'xjalmqTCG4aMtWcFU52', 'a5XYSnTjqcktGegWcoe', 'ufFk1lTl8rmilvZsFEe', 'QbrjKET5sPu0G8JiTTN'
            Source: J7XIGd3DCJ.exe, Y41iJuJM7HQv0QTKy6B.csHigh entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'AuSaTxeBS0wxcTbG03P', 'DxuAVYe0QZB7bK8OaKh', 'b6lRT5eVIOoCH5Jdb6m', 'P6JNTweW5Pohp5vpmTH', 'UKeAf5ePkkV6Ie8J70q', 'rf2sw2ezpcVAkgCTuv3'
            Source: J7XIGd3DCJ.exe, kywA9BwJrNLuKYo1MGZ.csHigh entropy of concatenated method names: 'g1lcKHZ517', 'e5ecw5t1O3', 'j4jcFX1wWH', 'unJck07eUh', 'peh7NPXznf21xxdhsQF', 'pkVprOXWwnmidHoifPu', 'AVA5hUXPDkPNVGf750g', 'O1sOBOvtcN6cUsimmgn', 'F0IElgvxWPOMkaZWOEb', 'IunPmNvcu0TqrQDjeIm'
            Source: J7XIGd3DCJ.exe, cf2OAcJJFgWfL4DDG2R.csHigh entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'ovAOy7evJLQRF2QojpF', 'yx0sNeeoPlpuasDLKHR', 'NmZAFKeLdZTIV8aVEkF', 'MMk4SHe6UOIah9RfRxq', 'CZO9hferQBToXAFpC1i', 'lYQpJOeG7OHLkIZexbM'
            Source: J7XIGd3DCJ.exe, VtSC8L76aYwEGyQDX4.csHigh entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'cxhlYdHDTwQMqjMyt9W', 'LL1kUlHbjgqR0tqiO0s', 'Eevo07H4Mv2BMjcZfLm', 'sjF90MH8KTbX3MPBah8', 'tHtH4MHMptijwRIbIX4', 'bVdgTBHn4ZbQtuOenJ0'
            Source: J7XIGd3DCJ.exe, v30YUPM1qf375566DKv.csHigh entropy of concatenated method names: 'ISsHqRUOitymCxsBTrK', 'eQOKsKURlQ0c8a3ETVi', 'zAB5MoUIaAw9Fo7QqHn', 'gS3NPvUa6tt05kGLZAg', 'kyxFUFGjcP', 'JYQvtXUCXmUP1nsa7NK', 'OonyC6UjkSCRQG1I1Xh', 'Kop3CoUluC0VQ2M74no', 'QJEexUU5THglw0DeKYs', 'ibi13lUSwGYa6sGriC7'
            Source: J7XIGd3DCJ.exe, qxNwjBJ2q23TsdwMZX2.csHigh entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'lG2udTNt4Vyyiu8h4Ye', 'bfp6AUNxjshrcP8kJVj', 'L9yFiQNcQpOOEtyrIRI', 'UKybJ3NKkfKP9YIGZk9', 'hxrFbrNHO1J0OaSxMeL', 'EfqZbnNTBfpEWiOGpB5'
            Source: J7XIGd3DCJ.exe, Y6TYXy3sbImPRpRA0qQ.csHigh entropy of concatenated method names: '_0023Nn', 'Dispose', 'SuSAhmgnwU', 'J6MAPCLguh', 'xQXAHo1Q6c', 'rdHAjBIBmQ', 'RFjASgQ5Zk', 'QeC0agwFqr5Th9lUQyL', 'rbrxvcwheZsJkvcqL7j', 'v7aet3wumIa3UUddsUx'
            Source: J7XIGd3DCJ.exe, PBca8Vw4sCeQeRfNkyn.csHigh entropy of concatenated method names: 'oYo', '_1Z5', 'h2QkcAR6Il', 'G0fG7vMONm', 'CQkkMK29mJ', 'qJ4OxmG8mXNrX5dRJVh', 'E9Dh5cGMHCcDqkln01w', 'rgVkffGnZTUQ4umr5kW', 'eKQw5SGyCgQFbhepx0P', 'GXJ2ASGirt74PgyBH3V'
            Source: J7XIGd3DCJ.exe, oXnRu8HCgofK7Mtc8Os.csHigh entropy of concatenated method names: 'pDQCo0COQo', 'SqqChWEnvb', 'i7sCP2NdUG', 't3bCHpaflX', 'DmtCjrSnFW', 'r6KOdWRvl3RE9e74hft', 'GLBXN2RwQLeAIh0rcwr', 'UXHqneRXHRRrAOtlmGp', 'jjMx0QRoKLpHpthSWet', 'j93bXjRLRVumIWISbOq'
            Source: J7XIGd3DCJ.exe, JLSdiBZi6KXF3qBkkS.csHigh entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'fwW3IITeduJ91d2itZ4', 'IKJUqxTuBZQBWMYFNA7', 'sicVG5TNXkGY3PUQKT2', 'cbWJqsTFo7LwQ0skwhq', 'CsyK5BThW52ouU8DtIl', 'dcsBKRTDie4HMPN0waa'
            Source: J7XIGd3DCJ.exe, xGcLb0wRRLoUsGECBpj.csHigh entropy of concatenated method names: '_5u9', 'AtMk7N4bEf', 'r72GdVFOFM', 'skJkAO6uoT', 'HOILZHrVEoe0weUAZ6U', 'UUQALtrWyOwAsG0lFUV', 'ffqbxXrPYreBZPvDTxf', 'qIxiebrB75LW7P65I8j', 'kDKayjr0ln7U3oJEKSi', 'eM99IYrzqgxMxIHRFep'

            Persistence and Installation Behavior

            barindex
            Creates processes via WMI
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Recovery\RCX4657.tmpJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Users\user\Desktop\RCX43F5.tmpJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Recovery\Registry.exeJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Recovery\RCX4C45.tmpJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Users\user\Desktop\J7XIGd3DCJ.exe (copy)Jump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile created: C:\Users\Public\Libraries\RCX4956.tmpJump to dropped file

            Boot Survival

            barindex
            Uses schtasks.exe or at.exe to add and modify task schedules
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\Registry.exe'" /f
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Recovery\Registry.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeMemory allocated: EC0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeMemory allocated: 1ABC0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeMemory allocated: 12B0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeMemory allocated: 1ACC0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeMemory allocated: 2770000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeMemory allocated: 1A7B0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\Registry.exeMemory allocated: 13A0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\Registry.exeMemory allocated: 1AEB0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\Registry.exeMemory allocated: ED0000 memory reserve | memory write watchJump to behavior
            Source: C:\Recovery\Registry.exeMemory allocated: 1A900000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeMemory allocated: 13A0000 memory reserve | memory write watch
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeMemory allocated: 1AEE0000 memory reserve | memory write watch
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Recovery\Registry.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Recovery\Registry.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWindow / User API: threadDelayed 1599Jump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeWindow / User API: threadDelayed 629Jump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeWindow / User API: threadDelayed 367Jump to behavior
            Source: C:\Recovery\Registry.exeWindow / User API: threadDelayed 364Jump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeWindow / User API: threadDelayed 448
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeWindow / User API: threadDelayed 417
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeDropped PE file which has not been started: C:\Users\user\Desktop\RCX43F5.tmpJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeDropped PE file which has not been started: C:\Recovery\RCX4C45.tmpJump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeDropped PE file which has not been started: C:\Users\user\Desktop\J7XIGd3DCJ.exe (copy)Jump to dropped file
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exe TID: 6960Thread sleep count: 1599 > 30Jump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exe TID: 6960Thread sleep count: 629 > 30Jump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe TID: 7488Thread sleep count: 302 > 30Jump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe TID: 7456Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe TID: 7556Thread sleep count: 367 > 30Jump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe TID: 7524Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Recovery\Registry.exe TID: 7628Thread sleep count: 326 > 30Jump to behavior
            Source: C:\Recovery\Registry.exe TID: 7628Thread sleep count: 105 > 30Jump to behavior
            Source: C:\Recovery\Registry.exe TID: 7552Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Recovery\Registry.exe TID: 7616Thread sleep count: 364 > 30Jump to behavior
            Source: C:\Recovery\Registry.exe TID: 7576Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe TID: 7868Thread sleep count: 448 > 30
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe TID: 7868Thread sleep count: 417 > 30
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe TID: 7844Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Recovery\Registry.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Recovery\Registry.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Recovery\Registry.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Recovery\Registry.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
            Source: J7XIGd3DCJ.exe, 00000000.00000002.1720124144.000000001BB6C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_
            Source: J7XIGd3DCJ.exe, RCX4C45.tmp.0.dr, BfsBBmsxHEOpauZphVFNsX.exe.0.dr, RCX43F5.tmp.0.dr, Registry.exe.0.dr, RCX4956.tmp.0.dr, RCX4657.tmp.0.dr, BfsBBmsxHEOpauZphVFNsX.exe0.0.drBinary or memory string: UqqEmuFVPRgufVYf10s
            Source: w32tm.exe, 00000013.00000002.1762591747.0000021524FA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Recovery\Registry.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Recovery\Registry.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeMemory allocated: page read and write | page guardJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat" Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe" Jump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeQueries volume information: C:\Users\user\Desktop\J7XIGd3DCJ.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeQueries volume information: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe VolumeInformationJump to behavior
            Source: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exeQueries volume information: C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe VolumeInformationJump to behavior
            Source: C:\Recovery\Registry.exeQueries volume information: C:\Recovery\Registry.exe VolumeInformationJump to behavior
            Source: C:\Recovery\Registry.exeQueries volume information: C:\Recovery\Registry.exe VolumeInformationJump to behavior
            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exeQueries volume information: C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe VolumeInformation
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Disable UAC(promptonsecuredesktop)
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeRegistry value created: PromptOnSecureDesktop 0Jump to behavior
            Disables UAC (registry)
            Source: C:\Users\user\Desktop\J7XIGd3DCJ.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected DCRat
            Source: Yara matchFile source: 00000014.00000002.1859128791.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.1779968766.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1714090175.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.1859128791.0000000002F1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.1774659453.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.1779541978.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.1776381068.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1715243053.0000000012BCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: J7XIGd3DCJ.exe PID: 6816, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: BfsBBmsxHEOpauZphVFNsX.exe PID: 7428, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: BfsBBmsxHEOpauZphVFNsX.exe PID: 7448, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Registry.exe PID: 7460, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Registry.exe PID: 7504, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: BfsBBmsxHEOpauZphVFNsX.exe PID: 7824, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected DCRat
            Source: Yara matchFile source: 00000014.00000002.1859128791.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.1779968766.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1714090175.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.1859128791.0000000002F1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.1774659453.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.1779541978.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.1776381068.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.1715243053.0000000012BCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: J7XIGd3DCJ.exe PID: 6816, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: BfsBBmsxHEOpauZphVFNsX.exe PID: 7428, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: BfsBBmsxHEOpauZphVFNsX.exe PID: 7448, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Registry.exe PID: 7460, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Registry.exe PID: 7504, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: BfsBBmsxHEOpauZphVFNsX.exe PID: 7824, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity Information1
            Scripting            		Valid Accounts11
            Windows Management Instrumentation            		1
            Scheduled Task/Job            		11
            Process Injection            		1
            Masquerading            		OS Credential Dumping11
            Security Software Discovery            		Remote Services11
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Scheduled Task/Job            		1
            Scripting            		1
            Scheduled Task/Job            		11
            Disable or Modify Tools            		LSASS Memory1
            Process Discovery            		Remote Desktop ProtocolData from Removable Media1
            Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAt1
            DLL Side-Loading            		1
            DLL Side-Loading            		31
            Virtualization/Sandbox Evasion            		Security Account Manager31
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
            Bypass User Account Control            		11
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets2
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
            Obfuscated Files or Information            		Cached Domain Credentials14
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items22
            Software Packing            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            DLL Side-Loading            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            Bypass User Account Control            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1431902 Sample: J7XIGd3DCJ.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for dropped file 2->44 46 8 other signatures 2->46 7 J7XIGd3DCJ.exe 5 19 2->7         started        11 Registry.exe 3 2->11         started        13 BfsBBmsxHEOpauZphVFNsX.exe 3 2->13         started        15 2 other processes 2->15 process3 file4 32 C:\Users\user\Desktop\RCX43F5.tmp, PE32 7->32 dropped 34 C:\Users\user\Desktop\J7XIGd3DCJ.exe (copy), PE32 7->34 dropped 36 C:\Users\Public\Libraries\RCX4956.tmp, PE32 7->36 dropped 38 6 other malicious files 7->38 dropped 48 Uses schtasks.exe or at.exe to add and modify task schedules 7->48 50 Disables UAC (registry) 7->50 52 Creates processes via WMI 7->52 54 Disable UAC(promptonsecuredesktop) 7->54 17 cmd.exe 1 7->17         started        19 schtasks.exe 7->19         started        21 schtasks.exe 7->21         started        23 7 other processes 7->23 56 Antivirus detection for dropped file 11->56 58 Multi AV Scanner detection for dropped file 11->58 60 Machine Learning detection for dropped file 11->60 signatures5 process6 process7 25 BfsBBmsxHEOpauZphVFNsX.exe 17->25         started        28 w32tm.exe 1 17->28         started        30 conhost.exe 17->30         started        signatures8 62 Multi AV Scanner detection for dropped file 25->62

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            J7XIGd3DCJ.exe88%ReversingLabsByteCode-MSIL.Ransomware.Prometheus
            J7XIGd3DCJ.exe100%AviraHEUR/AGEN.1323984
            J7XIGd3DCJ.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Recovery\RCX4C45.tmp100%AviraHEUR/AGEN.1323984
            C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe100%AviraHEUR/AGEN.1323984
            C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat100%AviraBAT/Delbat.C
            C:\Users\user\Desktop\RCX43F5.tmp100%AviraHEUR/AGEN.1323984
            C:\Recovery\Registry.exe100%AviraHEUR/AGEN.1323984
            C:\Users\Public\Libraries\RCX4956.tmp100%AviraHEUR/AGEN.1323984
            C:\Recovery\RCX4657.tmp100%AviraHEUR/AGEN.1323984
            C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe100%AviraHEUR/AGEN.1323984
            C:\Recovery\RCX4C45.tmp100%Joe Sandbox ML
            C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe100%Joe Sandbox ML
            C:\Users\user\Desktop\RCX43F5.tmp100%Joe Sandbox ML
            C:\Recovery\Registry.exe100%Joe Sandbox ML
            C:\Users\Public\Libraries\RCX4956.tmp100%Joe Sandbox ML
            C:\Recovery\RCX4657.tmp100%Joe Sandbox ML
            C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe100%Joe Sandbox ML
            C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe82%ReversingLabsByteCode-MSIL.Ransomware.Prometheus
            C:\Recovery\Registry.exe82%ReversingLabsByteCode-MSIL.Ransomware.Prometheus
            C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe82%ReversingLabsByteCode-MSIL.Ransomware.Prometheus

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://cz24519.tw1.ru/@zd3bk5Wa3RHb1FmZlR0Xfalse
              		high

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameJ7XIGd3DCJ.exe, 00000000.00000002.1714090175.0000000002D41000.00000004.00000800.00020000.00000000.sdmpfalse
                		high

                World Map of Contacted IPs

                ⊘No contacted IP infos

                General Information

                Joe Sandbox version:40.0.0 Tourmaline
                Analysis ID:1431902
                Start date and time:2024-04-26 00:06:06 +02:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 7m 33s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:25
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample name:J7XIGd3DCJ.exe
                renamed because original name is a hash value
                Original Sample Name:19d8a91e9b3652cfc0bb5165e5c3ff52.exe
                Detection:MAL
                Classification:mal100.troj.evad.winEXE@21/20@0/0
                EGA Information:Failed
                HCA Information:Failed
                Cookbook Comments:
                • Found application associated with file extension: .exe

                Warnings

                • Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                • Execution Graph export aborted for target BfsBBmsxHEOpauZphVFNsX.exe, PID 7428 because it is empty
                • Execution Graph export aborted for target BfsBBmsxHEOpauZphVFNsX.exe, PID 7448 because it is empty
                • Execution Graph export aborted for target BfsBBmsxHEOpauZphVFNsX.exe, PID 7824 because it is empty
                • Execution Graph export aborted for target J7XIGd3DCJ.exe, PID 6816 because it is empty
                • Execution Graph export aborted for target Registry.exe, PID 7460 because it is empty
                • Execution Graph export aborted for target Registry.exe, PID 7504 because it is empty
                • Not all processes where analyzed, report is missing behavior information
                • Report size exceeded maximum capacity and may have missing behavior information.
                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                • Report size getting too big, too many NtOpenKeyEx calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.
                • VT rate limit hit for: J7XIGd3DCJ.exe

                Simulations

                Behavior and APIs

                TimeTypeDescription
                23:06:59Task SchedulerRun new task: BfsBBmsxHEOpauZphVFNsX path: "C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe"
                23:06:59Task SchedulerRun new task: BfsBBmsxHEOpauZphVFNsXB path: "C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe"
                23:06:59Task SchedulerRun new task: Registry path: "C:\Recovery\Registry.exe"
                23:06:59Task SchedulerRun new task: RegistryR path: "C:\Recovery\Registry.exe"

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Recovery\8e96dd8ad599f1

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with very long lines (316), with no line terminators
                Category:dropped
                Size (bytes):316
                Entropy (8bit):5.737827436120502
                Encrypted:false
                SSDEEP:6:8lS6S32/dTA1ho3SikDcdBBxfUsRpDieGdcI3ESSLkIZLQ9:8lSLmVs1K1KUBPfU8xI3ESKLo
                MD5:7094F54ED230DE127136B05CCC747624
                SHA1:6EC7C1DB37B24325B50429C7A048C53695080531
                SHA-256:53307FF795256FA34EB294ABB4E2461D9E393BE285B74D1C9129028616679E4F
                SHA-512:35048B71119608B95B073A7CF39344C2C3EE474816A3EC4107623ACB79F289A5714A357CBA70F5553D8CF0E979AE02339219152FCDA17D8211CED145E8B1A9DF
                Malicious:false
                Preview:4yxx2gCyNgSOZBSXXxP0VVOA6AP4caJU1XQheJU7kBpz2UfASxFt1S8ijw02RHVxW8XCvv3NcSPTqZImePmpVZciYs7rSbqdp1c47cPg41QjCo1KoOXCeqc7fynCyM5Blwoz7OpB9GveI2fu0wDDDo98ZeYIzMrr5P8QACNZjWCX57zmS3MBJ287xpZczgMxZDi34PuyjnermlDbpw06ApiDQBcUmukDJO82Z5sCIXcgYRVMm7wDqQxtefm3xZLyCahXmLCuDxxmNCp9qQsp8gW3bPX3TzPsMnd7t7jb4C92cKfc0mNgrg0gEn5X

                C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.241983795621537
                Encrypted:false
                SSDEEP:24576:ZJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:ZWi0Dx80zem3rgMNfMJc7qKV
                MD5:19D8A91E9B3652CFC0BB5165E5C3FF52
                SHA1:649F59EAE10939DF994DB941AABC1FB78F6A0AAE
                SHA-256:A7026EB135336FC541BB8CF376DE89754873BFE36CBA3098FBD6BDFB8C22A89D
                SHA-512:903C11934123B6D13783F1724FF1522EB88FE41E75855D1E8761A5D06326BDC3F250986F0A2DE7D126E0189776B3418F19DBF0BB3AAAEEF6CD3DB2A9484EBB19
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 82%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.......T............................................................................ ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...T...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe:Zone.Identifier

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):26
                Entropy (8bit):3.95006375643621
                Encrypted:false
                SSDEEP:3:ggPYV:rPYV
                MD5:187F488E27DB4AF347237FE461A079AD
                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                Malicious:false
                Preview:[ZoneTransfer]....ZoneId=0

                C:\Recovery\RCX4657.tmp

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.2418803922227255
                Encrypted:false
                SSDEEP:24576:5JOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:5Wi0Dx80zem3rgMNfMJc7qKV
                MD5:757CD80AA5AFC0AEEDD8B162676E0B85
                SHA1:29C21AE84494BF30635C70322558A9A05D060612
                SHA-256:E3D18790DE67493DBE328E55088E4F0A7B7CEF0C9BDBA0CD5F296785223482D6
                SHA-512:AE6E38BC0A8A3BF68F1110970305B3D762D6E6BC97BA56A8E58BD3E0619DD05D2ACBBED2ED74B0A4F4AB4114C1304ED2F97BDAA990B1D64221C2F4C951E33D94
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.................................................................................... ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Recovery\RCX4C45.tmp

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.241947259337771
                Encrypted:false
                SSDEEP:24576:5JOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:5Wi0Dx80zem3rgMNfMJc7qKV
                MD5:0E84D616BFE36559C977068E7A88D63A
                SHA1:AA2001BEED04CE1DD29531C5B0A713290C3B1C89
                SHA-256:7E3E6E7D76C3EE128A14879C13317B917C605A60AABF40363832D298EABEDAEF
                SHA-512:A3F2D78733064D07F85A6C527CFF3A5594018684CECBC398343800C359E45730B55546C16E1BF7C14A9D17E790BB68CE3ADAE954B5AE34118399603C3EBA71F7
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.......|............................................................................ ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...|...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Recovery\Registry.exe

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.241983795621537
                Encrypted:false
                SSDEEP:24576:ZJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:ZWi0Dx80zem3rgMNfMJc7qKV
                MD5:19D8A91E9B3652CFC0BB5165E5C3FF52
                SHA1:649F59EAE10939DF994DB941AABC1FB78F6A0AAE
                SHA-256:A7026EB135336FC541BB8CF376DE89754873BFE36CBA3098FBD6BDFB8C22A89D
                SHA-512:903C11934123B6D13783F1724FF1522EB88FE41E75855D1E8761A5D06326BDC3F250986F0A2DE7D126E0189776B3418F19DBF0BB3AAAEEF6CD3DB2A9484EBB19
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 82%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.......T............................................................................ ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...T...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Recovery\Registry.exe:Zone.Identifier

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):26
                Entropy (8bit):3.95006375643621
                Encrypted:false
                SSDEEP:3:ggPYV:rPYV
                MD5:187F488E27DB4AF347237FE461A079AD
                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                Malicious:false
                Preview:[ZoneTransfer]....ZoneId=0

                C:\Recovery\ee2ad38f3d4382

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with very long lines (882), with no line terminators
                Category:dropped
                Size (bytes):882
                Entropy (8bit):5.902808712915008
                Encrypted:false
                SSDEEP:24:bxhzqHDoJ9B1VCiNGjkaeT5NaDH5ubsM0:bio7dCiYkaeTYHwQM0
                MD5:4EE9C229942C3C20CB85B7FEA4D2213E
                SHA1:9AC6682CED5455918B234A46853CC6C4AAD55690
                SHA-256:29BE5EC5301F06002164B91457DC5D62495FFA22FF98F3E38B0F8D61748247CE
                SHA-512:1B173CDE00BEC7062DAACB87C912F117D3CBE6463232AE1A2B2F81D0FFACFC82750BB53BA83B78C15EDFAA76674403B1564BF88C22E3FCBAEE8B49162722F4BA
                Malicious:false
                Preview:tPLL7azM1EjsyitXsVskp2dTY47HAYRaH788DN5oHEAzs5FT0DGL0dM0w2wCcsMcwJl1juUeaEdk2nkdynR7SFjouILKa2LY2hDjTOuFslvw9l8JSTNzbOJqj6HbjKDh3FrUkAJk3LOqUxpIJC2HoW7oYWAXHSfiiN344njRJn5P9dWvR8RhR52gHD6N9wdkpqIH4vOgck7Bbro5APGIB8QmUWw0rVRXJUkTVO1guvEq81FZYANupVjqZfwh8XyHSj1GHVkvXkYQ4kodQWbqIhsyv33zbThW77YY98SDabWF7Swz0TQl6H9v1DVObuTDCBT7LQeREYQqKm1cGE8IC5az7mg5nDlqHSC59znkz8hh1SkOL3HWvKAGld9jtioAwji1j6cRbYTEY28pBRtt5O46R5TgzE0QUhuRutpPa05X16sseUhcy5Eipljnm6bXhCu0Ir5SmeSFTgFVNlBfhYcZcMmIJBneYizyM1kxZOzUm9PIfOaB56zJkVY5FwJl0yqurRIVANGSiIwc7dm4kmicsqN1dosmEOdxTebOGFArzhkci68lJOAOPNCADQ1VedNTo8IcCYxel0nLFvTgpHczNPhGcaL0NpNVTQyjxgivagmYk15R7VqXBXGYbCAmM7Q6nR1y7utJjrZrmJflf3329zU5KZIuf6idPqvS9GUMlgyT8ZvRgZHTEX7y76nhl8nmI6b6XNmYjqQcBA6vo0OGyPY2t7VCcxln2LLC7y3TxstYGew6A22vuhy2hjNa1j5vEnjzz3xz64TFf9vOKZCk4z3VXSfYldcNx8Td46GGECy0OsWix9QchU0OtOchYZOdbFShpSTNS5g1BDGo56kmMAqcHEtqdjroyVYJaz2fpCJly8

                C:\Users\Public\Libraries\8e96dd8ad599f1

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):279
                Entropy (8bit):5.810138992643679
                Encrypted:false
                SSDEEP:6:ZEWbvA1iHAu3fKBBl8Vi7rXT/+FL6sDjxtkdWKQ8CWIV3Bp44Fj:nbooHAIA6nFDjXf8gq4t
                MD5:D6EF68855A69885EF6FDE3D2591CCF8C
                SHA1:208B7FB94B09D74C9547B041C2C3A5D6F0678A71
                SHA-256:3422AE0C45BFED5353C58691E366529E917ACB5F3354AF39D03CB4EC675C854E
                SHA-512:D84F2E901EC1517DDABF7BABB935C81C0E3D345B402C6D5123D2C4D3CF5860CF154DAD79965A7175465727151623BAEBD1B376C613356CC8F4882DD3630A0AC5
                Malicious:false
                Preview:bYzakintsO1Dqp7OGEF6J0EoI1Dhp8P0ME6ukZR7BSbX65hAKjfXtpGlTLRteFDu8B1ltNoqwI41ZrrNTCXGc2Hg7UaYHic6OqY5E5R74ykkuPMmeEZbs7RF3UoYxPiOp8msSvIXvaLoSgwrIy4DIAORYTBuR3JpPW5vneTs5BqRvnxXh6Q9VfFouUT9uYG2QgY6lADneMHGU6gvfoMVmKTtQQBTKT8h5yBOP1wg2meIY8TyyidFLuPFMopU9udLOkLg5Rfo2pcAqLVR7Mem02V

                C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.241983795621537
                Encrypted:false
                SSDEEP:24576:ZJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:ZWi0Dx80zem3rgMNfMJc7qKV
                MD5:19D8A91E9B3652CFC0BB5165E5C3FF52
                SHA1:649F59EAE10939DF994DB941AABC1FB78F6A0AAE
                SHA-256:A7026EB135336FC541BB8CF376DE89754873BFE36CBA3098FBD6BDFB8C22A89D
                SHA-512:903C11934123B6D13783F1724FF1522EB88FE41E75855D1E8761A5D06326BDC3F250986F0A2DE7D126E0189776B3418F19DBF0BB3AAAEEF6CD3DB2A9484EBB19
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 82%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.......T............................................................................ ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...T...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe:Zone.Identifier

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):26
                Entropy (8bit):3.95006375643621
                Encrypted:false
                SSDEEP:3:ggPYV:rPYV
                MD5:187F488E27DB4AF347237FE461A079AD
                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                Malicious:false
                Preview:[ZoneTransfer]....ZoneId=0

                C:\Users\Public\Libraries\RCX4956.tmp

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.24213563743735
                Encrypted:false
                SSDEEP:24576:hJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:hWi0Dx80zem3rgMNfMJc7qKV
                MD5:58AB2ACD0ED54008D68BBF03FCCC4BBF
                SHA1:B4C533D4A83E2DF47E58C2F7FC3E17332DFD0D6A
                SHA-256:A1383589F3905FDB3CB99212ADA0E8BC9EF9850404B0FA6FA1F3D524B66805D1
                SHA-512:2B9A90CDF6F2C58C5F106E4C190A867E2A5DF8090BD57376C291C85F1E13D522731CF385A6AD9FC3F3D2B81DD315A661CED80DB4D907D9A137A7CC8673E60A93
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.................................................................................... ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BfsBBmsxHEOpauZphVFNsX.exe.log

                Download File
                Process:C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
                File Type:CSV text
                Category:dropped
                Size (bytes):1281
                Entropy (8bit):5.370111951859942
                Encrypted:false
                SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
                MD5:12C61586CD59AA6F2A21DF30501F71BD
                SHA1:E6B279DC134544867C868E3FF3C267A06CE340C7
                SHA-256:EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
                SHA-512:B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
                Malicious:false
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\J7XIGd3DCJ.exe.log

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1830
                Entropy (8bit):5.3661116947161815
                Encrypted:false
                SSDEEP:48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpvJHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpBGqZ8
                MD5:498D8CC0F157AA5168D6679E694BD803
                SHA1:05A8C750A8FC7F3438945EC9607C4F240917C31B
                SHA-256:5A452026BD10A826A716DD6A5B5D7D731458217CD89CD9F24FFC5A52AE6CD35F
                SHA-512:9924A15F7EC4B178E0C7B2BA6CDA7D26787372E63C49B66019D13696C14BFA3AADD2A597416E3589CE8B3F6AB4C9EE32A8BAA7C66ADDEA7A09C78B90B33CC893
                Malicious:false
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

                Download File
                Process:C:\Recovery\Registry.exe
                File Type:CSV text
                Category:dropped
                Size (bytes):1281
                Entropy (8bit):5.370111951859942
                Encrypted:false
                SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
                MD5:12C61586CD59AA6F2A21DF30501F71BD
                SHA1:E6B279DC134544867C868E3FF3C267A06CE340C7
                SHA-256:EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
                SHA-512:B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
                Malicious:false
                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                C:\Users\user\AppData\Local\Temp\LBD9ZEOrYT

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):25
                Entropy (8bit):4.403856189774722
                Encrypted:false
                SSDEEP:3:Tgg0JkogLYn:sPkTLYn
                MD5:A2952F1F8A455716FECAB8371262F8B1
                SHA1:6AB413B88D319B2AEFA9871F6EF57CBDCFE2A77C
                SHA-256:7C8730B49B094DEC16FB21A80B2C29F3705929746E873FF81A1A770932894DBE
                SHA-512:D0C0EC1A53534C23E5E7A30792E94E1F17B2A42B2B074E95C6B8E8D53F313DD7055C1B4FE9DE771F24BDF6B892E98B81DD19730B67D255E4B238AA9B3D34D794
                Malicious:false
                Preview:zJVEbn9q7TQl7rm6B3BeKWC3L

                C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:DOS batch file, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):217
                Entropy (8bit):5.206644099550799
                Encrypted:false
                SSDEEP:6:hITg3Nou11r+DE1aH1BLbG9kbKOZG1wkn23fQ8q:OTg9YDEOBLbG9yfy
                MD5:3306EE7F356F4066157017DE88A38B95
                SHA1:F4EB1AC4E3CC8D2A61E623576A5736BDCA8C24D4
                SHA-256:E6F2D0027F8A0989036A3FB32668CDB25EF38F90CC26682726B299DD881F7AF3
                SHA-512:3E1A75B664B87186A478B6CC15688E79710340DB04509B9ECE26766EA7A4794091DC676C16BB802610B7392DFF21EDD583D6D1CE45B75CA98288F4D4949CC679
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                Preview:@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\xx1rvPQXwC.bat"

                C:\Users\user\Desktop\J7XIGd3DCJ.exe (copy)

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.24201858519054
                Encrypted:false
                SSDEEP:24576:hJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:hWi0Dx80zem3rgMNfMJc7qKV
                MD5:7E2A2CFF2B1BC045262F8DFA498A06FD
                SHA1:960A4AB9A47239127FDE11AA3F22ECB0AE00293A
                SHA-256:65D48389681D2AC450A4971EBF6641EF36DE648984C0EDC18A1E54C884472282
                SHA-512:9977A150722EC5FDB11A20A3874E9F6B93328E29EFA1263905013CC5D549EF8A80FA7A938D336653A409F366AF6461139A4FAF6EB3BC94A8E436D53F66CCB1C5
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.......H............................................................................ ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\Desktop\RCX43F5.tmp

                Download File
                Process:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Category:dropped
                Size (bytes):1550848
                Entropy (8bit):7.24201858519054
                Encrypted:false
                SSDEEP:24576:hJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:hWi0Dx80zem3rgMNfMJc7qKV
                MD5:7E2A2CFF2B1BC045262F8DFA498A06FD
                SHA1:960A4AB9A47239127FDE11AA3F22ECB0AE00293A
                SHA-256:65D48389681D2AC450A4971EBF6641EF36DE648984C0EDC18A1E54C884472282
                SHA-512:9977A150722EC5FDB11A20A3874E9F6B93328E29EFA1263905013CC5D549EF8A80FA7A938D336653A409F366AF6461139A4FAF6EB3BC94A8E436D53F66CCB1C5
                Malicious:true
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................p...6........... ........@.. ....................... ............@.................................P...K.......H............................................................................ ............... ..H............text....o... ...p.................. ..`.sdata.../.......0...t..............@....rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                \Device\Null

                Download File
                Process:C:\Windows\System32\w32tm.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):151
                Entropy (8bit):4.763826331013006
                Encrypted:false
                SSDEEP:3:VLV993J+miJWEoJ8FXkRMpUsNLzNJ86vpG0fKLyXKNvj:Vx993DEUyprNLzNJ0mM
                MD5:1AE7B0F8A31B827A1E23EDCB7EF531AA
                SHA1:79AAF7EFA55272749C53CE92DB59E8253021F2E4
                SHA-256:EABCE5B88738012A1C85751FFE25BBD1E21F27215EBB0E9B937ACB690E2E4B4A
                SHA-512:2D8C3F9EB5D24B3F2F7602B7FCD99A96062F18F617DEF73DFA79AD37AED4CD6904837E52FB1ED69BB9A6E20AA08802504036C8BB9776ADF6F30142A686144E57
                Malicious:false
                Preview:Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 26/04/2024 01:47:11..01:47:11, error: 0x80072746.01:47:16, error: 0x80072746.

                Static File Info

                General

                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Entropy (8bit):7.241983795621537
                TrID:
                • Win32 Executable (generic) Net Framework (10011505/4) 49.79%
                • Win32 Executable (generic) a (10002005/4) 49.75%
                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                • Windows Screen Saver (13104/52) 0.07%
                • Win16/32 Executable Delphi generic (2074/23) 0.01%
                File name:J7XIGd3DCJ.exe
                File size:1'550'848 bytes
                MD5:19d8a91e9b3652cfc0bb5165e5c3ff52
                SHA1:649f59eae10939df994db941aabc1fb78f6a0aae
                SHA256:a7026eb135336fc541bb8cf376de89754873bfe36cba3098fbd6bdfb8c22a89d
                SHA512:903c11934123b6d13783f1724ff1522eb88fe41e75855d1e8761a5d06326bdc3f250986f0a2de7d126e0189776b3418f19dbf0bb3aaaeef6cd3db2a9484ebb19
                SSDEEP:24576:ZJOKkuLgnh7L7yK7YxIEsNmvvEiobrjDxKg5EPavsasRbPfyRAm3TXPoehNWRJd5:ZWi0Dx80zem3rgMNfMJc7qKV
                TLSH:CD758B027E44CE11F0191333C2EF499897B4A95176A6E32B7DBA37AD65123A73C0D9CB
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.................p...6........... ........@.. ....................... ............@................................

                File Icon

                Icon Hash:90cececece8e8eb0

                Static PE Info

                General

                Entrypoint:0x578f9e
                Entrypoint Section:.text
                Digitally signed:false
                Imagebase:0x400000
                Subsystem:windows gui
                Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Time Stamp:0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:4
                OS Version Minor:0
                File Version Major:4
                File Version Minor:0
                Subsystem Version Major:4
                Subsystem Version Minor:0
                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                Entrypoint Preview

                Instruction
                jmp dword ptr [00402000h]
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IMPORT0x178f500x4b.text
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x17e0000x354.rsrc
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x1800000xc.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text

                Sections

                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x20000x176fa40x177000e95dfbaecefa2392f5fc7338e7e0771dFalse0.7327890625data7.268458842101928IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                .sdata0x17a0000x2fdf0x30004d00c8743baa99541b9aaa781034ab3eFalse0.310302734375data3.2434317637547707IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .rsrc0x17e0000x3540x400bc8ae8da0a4d435dbfb87db29a066413False0.462890625data3.950279346918144IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .reloc0x1800000xc0x20064e30b3459de01f18613714f8037de81False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                Resources

                NameRVASizeTypeLanguageCountryZLIB Complexity
                RT_VERSION0x17e0580x2fcdataEnglishUnited States0.5484293193717278

                Imports

                DLLImport
                mscoree.dll_CorExeMain

                Possible Origin

                Language of compilation systemCountry where language is spokenMap
                EnglishUnited States

                Network Behavior

                ⊘No network behavior found

                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:00:06:55
                Start date:26/04/2024
                Path:C:\Users\user\Desktop\J7XIGd3DCJ.exe
                Wow64 process (32bit):false
                Commandline:"C:\Users\user\Desktop\J7XIGd3DCJ.exe"
                Imagebase:0x720000
                File size:1'550'848 bytes
                MD5 hash:19D8A91E9B3652CFC0BB5165E5C3FF52
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1714090175.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1714090175.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1715243053.0000000012BCD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Reputation:low
                Has exited:true

                General

                Target ID:3
                Start time:00:06:57
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\Registry.exe'" /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:4
                Start time:00:06:57
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\Registry.exe'" /rl HIGHEST /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:6
                Start time:00:06:57
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\Registry.exe'" /rl HIGHEST /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:7
                Start time:00:06:57
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:8
                Start time:00:06:57
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsX" /sc ONLOGON /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:9
                Start time:00:06:57
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:10
                Start time:00:06:58
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 13 /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:11
                Start time:00:06:58
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsX" /sc ONLOGON /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:12
                Start time:00:06:58
                Start date:26/04/2024
                Path:C:\Windows\System32\schtasks.exe
                Wow64 process (32bit):false
                Commandline:schtasks.exe /create /tn "BfsBBmsxHEOpauZphVFNsXB" /sc MINUTE /mo 6 /tr "'C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe'" /rl HIGHEST /f
                Imagebase:0x7ff76f990000
                File size:235'008 bytes
                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:13
                Start time:00:06:59
                Start date:26/04/2024
                Path:C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
                Wow64 process (32bit):false
                Commandline:C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
                Imagebase:0x900000
                File size:1'550'848 bytes
                MD5 hash:19D8A91E9B3652CFC0BB5165E5C3FF52
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000D.00000002.1774659453.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Antivirus matches:
                • Detection: 100%, Avira
                • Detection: 100%, Avira
                • Detection: 100%, Joe Sandbox ML
                • Detection: 100%, Joe Sandbox ML
                • Detection: 82%, ReversingLabs
                Reputation:low
                Has exited:true

                General

                Target ID:14
                Start time:00:06:59
                Start date:26/04/2024
                Path:C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
                Wow64 process (32bit):false
                Commandline:C:\Recovery\BfsBBmsxHEOpauZphVFNsX.exe
                Imagebase:0x510000
                File size:1'550'848 bytes
                MD5 hash:19D8A91E9B3652CFC0BB5165E5C3FF52
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000E.00000002.1776381068.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Reputation:low
                Has exited:true

                General

                Target ID:15
                Start time:00:06:59
                Start date:26/04/2024
                Path:C:\Recovery\Registry.exe
                Wow64 process (32bit):false
                Commandline:C:\Recovery\Registry.exe
                Imagebase:0xaf0000
                File size:1'550'848 bytes
                MD5 hash:757CD80AA5AFC0AEEDD8B162676E0B85
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000F.00000002.1779541978.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Antivirus matches:
                • Detection: 100%, Avira
                • Detection: 100%, Joe Sandbox ML
                • Detection: 82%, ReversingLabs
                Reputation:low
                Has exited:true

                General

                Target ID:16
                Start time:00:06:59
                Start date:26/04/2024
                Path:C:\Recovery\Registry.exe
                Wow64 process (32bit):false
                Commandline:C:\Recovery\Registry.exe
                Imagebase:0x720000
                File size:1'550'848 bytes
                MD5 hash:757CD80AA5AFC0AEEDD8B162676E0B85
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.1779968766.0000000002901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Reputation:low
                Has exited:true

                General

                Target ID:17
                Start time:00:07:01
                Start date:26/04/2024
                Path:C:\Windows\System32\cmd.exe
                Wow64 process (32bit):false
                Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xx1rvPQXwC.bat"
                Imagebase:0x7ff68e520000
                File size:289'792 bytes
                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:18
                Start time:00:07:01
                Start date:26/04/2024
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff7699e0000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:19
                Start time:00:07:01
                Start date:26/04/2024
                Path:C:\Windows\System32\w32tm.exe
                Wow64 process (32bit):false
                Commandline:w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                Imagebase:0x7ff688e10000
                File size:108'032 bytes
                MD5 hash:81A82132737224D324A3E8DA993E2FB5
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:true

                General

                Target ID:20
                Start time:00:07:06
                Start date:26/04/2024
                Path:C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe
                Wow64 process (32bit):false
                Commandline:"C:\Users\Public\Libraries\BfsBBmsxHEOpauZphVFNsX.exe"
                Imagebase:0xb00000
                File size:1'550'848 bytes
                MD5 hash:58AB2ACD0ED54008D68BBF03FCCC4BBF
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000014.00000002.1859128791.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000014.00000002.1859128791.0000000002F1F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                Antivirus matches:
                • Detection: 82%, ReversingLabs
                Has exited:true

                Disassembly

                Reset < >

                  Executed Functions

                  Function 00007FFD9B8B9969 Relevance: 1.2, Instructions: 1198COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fe8fe815c16c7c98af85fe89f03da758bb128db0054fa13e3f5f1fa72f3bc165
                  • Instruction ID: 836ced34e3bb5257d3db4924df17f3292bbac2ff825c274d1a8baf40e971096a
                  • Opcode Fuzzy Hash: fe8fe815c16c7c98af85fe89f03da758bb128db0054fa13e3f5f1fa72f3bc165
                  • Instruction Fuzzy Hash: 69928D30A0E69E8FDB56DB74C8695A97FF0FF1A300F0604EBD459CB1A2DA34A544CB51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC4AB Relevance: .7, Instructions: 662COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2707d01c977851ed5056e68eb767fe9c5583eb1f9e8c79e436b1ebf9482a0c2b
                  • Instruction ID: 3c9f03567b5c4a89c5a724bbc358275c0fc1252b9c14fbfbbd715c6524e22c9d
                  • Opcode Fuzzy Hash: 2707d01c977851ed5056e68eb767fe9c5583eb1f9e8c79e436b1ebf9482a0c2b
                  • Instruction Fuzzy Hash: 8E325C70A0A60E8FEB55EFA8C4656FD7BF0FF19310F11057AD419D71A6DA38AA44CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA46D Relevance: .4, Instructions: 378COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ed1a608bc7ce7ccaa5e50080cfd6bfce4304c338aafef12532deb7d01ec763af
                  • Instruction ID: d0fd4d24e93a0ba6a2e06458d5755b4204bdca422992d2c10f942a9a68a490ca
                  • Opcode Fuzzy Hash: ed1a608bc7ce7ccaa5e50080cfd6bfce4304c338aafef12532deb7d01ec763af
                  • Instruction Fuzzy Hash: 32C1D130A0A65E9FD756EB74C8695E97BB0FF0A314F0645BBD409C70A2EE38A644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAA60 Relevance: .4, Instructions: 377COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 39b6b1a812eae59745d2c3166c795bc17ab95e099159e7980bcc07cf14d067b5
                  • Instruction ID: ce8b7f45596607afc9cef54f9ecf32944991b0493366eb4a3cf448be8a0f72d3
                  • Opcode Fuzzy Hash: 39b6b1a812eae59745d2c3166c795bc17ab95e099159e7980bcc07cf14d067b5
                  • Instruction Fuzzy Hash: A6D1A170A0A64E8FEBA5EB64886A6F97BE1FF19300F0105BBD41DC71A6DF346644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC458 Relevance: .3, Instructions: 291COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fe27ffeedcafda1a31aae2c1d18981dec5461c6a580b3c609ae854bd9d5a140d
                  • Instruction ID: 25900380b5a754077076f701065d37ace5ad824e67af7756719b2b446c7e1af4
                  • Opcode Fuzzy Hash: fe27ffeedcafda1a31aae2c1d18981dec5461c6a580b3c609ae854bd9d5a140d
                  • Instruction Fuzzy Hash: 47A1D030A0A64E8FDB59EF64C4686FD7BF1FF59300F1149BAD419C71A6CA78A644CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC3BD Relevance: 2.6, Strings: 2, Instructions: 146COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: :$X
                  • API String ID: 0-2081125758
                  • Opcode ID: fe7241ad6166ea535d0629bc1cd371d19dc33c1316e34326ca603b52fc1dbb0b
                  • Instruction ID: 9fbf25e59b1ed28f2220d91d265783a1c63f42142d24883cf0f78272ddc8b33f
                  • Opcode Fuzzy Hash: fe7241ad6166ea535d0629bc1cd371d19dc33c1316e34326ca603b52fc1dbb0b
                  • Instruction Fuzzy Hash: 30512E70A0991D9FEBA8EBA8C8657ADB7F1FF59700F11017AD00EE7291DE3469418B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BE808 Relevance: 2.5, Strings: 2, Instructions: 44COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: 1$^
                  • API String ID: 0-2815675360
                  • Opcode ID: 8249b88d454165f56544c97ff7ed50eaf4d343571a157fc4bc57267c9d70a67e
                  • Instruction ID: f1bfa429d710494d9f80240620594eca15cf014c7139891dd30870824f89e5a9
                  • Opcode Fuzzy Hash: 8249b88d454165f56544c97ff7ed50eaf4d343571a157fc4bc57267c9d70a67e
                  • Instruction Fuzzy Hash: 8711FB70D0962E8EEB78DF54C8547E9B7B1EF58306F0041BAD00DA26A1CB385AC0CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BE2B6 Relevance: 2.5, Strings: 2, Instructions: 41COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: Z${
                  • API String ID: 0-2824158054
                  • Opcode ID: 73b0fd96eff9670fb64e8e8f5acee7a9123e5f63166bc1f7b0990b07f3a5064c
                  • Instruction ID: 4948da8f45f182e5622024a8f970645c476a2b5fea005e040400084670126799
                  • Opcode Fuzzy Hash: 73b0fd96eff9670fb64e8e8f5acee7a9123e5f63166bc1f7b0990b07f3a5064c
                  • Instruction Fuzzy Hash: DB111F70D4866E8FEB64DF14C8A43E9B7B1BB18302F1105B9D00DA26A0DB785BC0CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0AC0 Relevance: 1.6, Strings: 1, Instructions: 376COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: H
                  • API String ID: 0-2852464175
                  • Opcode ID: 94f0f31789964ed25bd592b1fbcbe046924c89956e4ecb6f491bb6c7c9aa5799
                  • Instruction ID: eb8e50a43aade74889778285c02dedd32a6384c91fc25b3acde35c39277c695c
                  • Opcode Fuzzy Hash: 94f0f31789964ed25bd592b1fbcbe046924c89956e4ecb6f491bb6c7c9aa5799
                  • Instruction Fuzzy Hash: 1AD1D330E1A65E4FEB64EB74C825BED77A1FF58700F0102BAD019D71E6DE34AA458B80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BEEDF Relevance: 1.3, Strings: 1, Instructions: 13COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: Z
                  • API String ID: 0-1505515367
                  • Opcode ID: bb9a78eca3829ce978813e031159cd8de0174bc2ac9e4e26cab93e14cb31b898
                  • Instruction ID: afa205902fb93a591f709d93b814c746c624f4204097e9d103b0fc9fdf3fab5e
                  • Opcode Fuzzy Hash: bb9a78eca3829ce978813e031159cd8de0174bc2ac9e4e26cab93e14cb31b898
                  • Instruction Fuzzy Hash: D7D01770909A6D8EEBA4DF188C213A97BB0EB18302F0100EA900DD2692DB301B808F81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD460 Relevance: .4, Instructions: 435COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 61cfcb4240926abfef135708ad8223d1d40960f98506ec48a74ada5c431b5918
                  • Instruction ID: 91e4bb54015c057ae72deccb9ba874ce477f86fececdf07fae8ff623b946f6fd
                  • Opcode Fuzzy Hash: 61cfcb4240926abfef135708ad8223d1d40960f98506ec48a74ada5c431b5918
                  • Instruction Fuzzy Hash: BAF18031A1969E8FEBA9DB64C8647F8BBB1FF19300F0501BAD01DD71E2DA386945CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2C08 Relevance: .4, Instructions: 425COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b568d62d57cad91281d53d43ccbf4687039cc01c7785a0e48eef1f90c518cc9c
                  • Instruction ID: ac296bedd6fb772849bfe79be2b49f31b9b1b8a8a21971770834b0c3e57a8133
                  • Opcode Fuzzy Hash: b568d62d57cad91281d53d43ccbf4687039cc01c7785a0e48eef1f90c518cc9c
                  • Instruction Fuzzy Hash: 3BF15D71E1965D9FEBA8DBA8C864BB8B7B1FF18300F0501BAD01DD72A6DA346941CF41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2C4A Relevance: .4, Instructions: 375COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 29f83c7ae3d40619f851f7824bf25e568dddcaef997dac5c7d04ca9ffe05239a
                  • Instruction ID: 2d729cbe39a73c6d24cd1471d8727b115c28e559f8ee39a8b25aef7731a9c372
                  • Opcode Fuzzy Hash: 29f83c7ae3d40619f851f7824bf25e568dddcaef997dac5c7d04ca9ffe05239a
                  • Instruction Fuzzy Hash: E6D1B430E0E65E8FE761EFB4D8696A97BE0FF09300F0545B6D418C71B6DA38A644CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD518 Relevance: .4, Instructions: 369COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8651b414db34a7d1d7bf2f3589b7caeede3f33258522c80be0770a73146a2616
                  • Instruction ID: ba7b2ee81926c64c1a2b82ad566f2035148a60c83efc0a807b7dbd88ba6f8dab
                  • Opcode Fuzzy Hash: 8651b414db34a7d1d7bf2f3589b7caeede3f33258522c80be0770a73146a2616
                  • Instruction Fuzzy Hash: 29D16C71A19A5E9FEBA8DB68C8647F8B7A1FF18304F0501BAD01DD72E2DE346940CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2BD8 Relevance: .4, Instructions: 350COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2581f9cb8df71ebf39592c12b6809184dd5d6ce6ce04af44b540b37b07d2441a
                  • Instruction ID: d25c52c2a9436d9207a25a8498f04c440fdbdcd712bd7daf604c49b3c60fae47
                  • Opcode Fuzzy Hash: 2581f9cb8df71ebf39592c12b6809184dd5d6ce6ce04af44b540b37b07d2441a
                  • Instruction Fuzzy Hash: 3AC16D71A19A5D8FEBACEB68D8647F8B7A1FF18304F0401BAD01DD71E6DA346981CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BCA08 Relevance: .3, Instructions: 344COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 726b598f6822529335067501cb8031182546995aad84e335b6e15af64b2c5fb6
                  • Instruction ID: 65fbd4caae41752228c39b1ac9c1a94878430cae094dc2fe1e45c8f30dbd03fb
                  • Opcode Fuzzy Hash: 726b598f6822529335067501cb8031182546995aad84e335b6e15af64b2c5fb6
                  • Instruction Fuzzy Hash: F5C1A770A0A68E8FEB65AB64886A6F97BF0FF19310F0505BBD41DC71A2DF386644C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1B15 Relevance: .3, Instructions: 307COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 256eb8d0bc1aee8df9eb63e7e29fe43328f8e08d1418144224cfcbd6b5384df6
                  • Instruction ID: e3d69b258e1e06000ff9cf546552250d2266be4b74b8e9cdad6d151b238663d4
                  • Opcode Fuzzy Hash: 256eb8d0bc1aee8df9eb63e7e29fe43328f8e08d1418144224cfcbd6b5384df6
                  • Instruction Fuzzy Hash: 78912531A1DB9D8FDB59EF2888655B97BE1FF99300F0501BED419CB292DE34A901CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD60A Relevance: .3, Instructions: 300COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dff892dd05ac9d44343af512e50266d771f1a53c090414515e87cb1d3be95e04
                  • Instruction ID: 19b2d079d00f0add9596ed0ed4b56666ffbbdc6e82aac855750b5b9e92bfad41
                  • Opcode Fuzzy Hash: dff892dd05ac9d44343af512e50266d771f1a53c090414515e87cb1d3be95e04
                  • Instruction Fuzzy Hash: 29B12C71A19A5D9FEBACDB68C8647A8B7A1FF58300F0401BED01DD72E6DA346981CF41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2075 Relevance: .3, Instructions: 297COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b3f029f57d909c43050f65674972282e203d781e01da98a508636e94e3674e54
                  • Instruction ID: 0c26368d43f2e76f2304256f51964be54ad43ae863c11ef2ed3bf9e2bd001919
                  • Opcode Fuzzy Hash: b3f029f57d909c43050f65674972282e203d781e01da98a508636e94e3674e54
                  • Instruction Fuzzy Hash: FF91F831E0E66E4FE775DFB498256B9BBA0FF49300F0541BAD01DC71E2DE286A458B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BDEDF Relevance: .3, Instructions: 289COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: df5eea7f0623e2bd4006d4e4f4f92e6fcf876f9e2ede7eda588fee6b627bc85d
                  • Instruction ID: 86b7e7bb9a0b718965728efb71817095680ca7f74bca442630d5f84078281492
                  • Opcode Fuzzy Hash: df5eea7f0623e2bd4006d4e4f4f92e6fcf876f9e2ede7eda588fee6b627bc85d
                  • Instruction Fuzzy Hash: 17A1A13090E79A8FE7669B7488252E93FB0FF1A301F0505FBD445C71E2DA28A655CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B16A8 Relevance: .3, Instructions: 285COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 48d65378a01b1dbaf07e669cdae32d1694c3b0c10dca2503a6634cf93d837542
                  • Instruction ID: c564a8dbba4732fdfc4634a42082a60a02eb6cb672eb89ee0dd39dfd0a7f3db9
                  • Opcode Fuzzy Hash: 48d65378a01b1dbaf07e669cdae32d1694c3b0c10dca2503a6634cf93d837542
                  • Instruction Fuzzy Hash: E381F031B1DA594FDB58EF6C88715A977E2FF98300B15017EE45DC72A2DE34A9028B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA8C8 Relevance: .3, Instructions: 282COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f73cfd1483889122464fadcb2021bba13666066e3c8a98625ae315318849cc34
                  • Instruction ID: cd57365d5bd0830ed8e9cafe74016b2b02027d4e8b3373fa005f21d16148a6c0
                  • Opcode Fuzzy Hash: f73cfd1483889122464fadcb2021bba13666066e3c8a98625ae315318849cc34
                  • Instruction Fuzzy Hash: 12A19270A1A78E8FEB65EF6488696FA3BF0FF19300F01057BD419C61A2DB38A654C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B05F0 Relevance: .3, Instructions: 277COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7cf020c578a7a834592f1ec232fb1849c2ff7897a6cc1b4742b28c96be1bda7a
                  • Instruction ID: 20211f73b08eb9ac8ce0200f02fc34fbe174813b2d62a364f07311f3f297515c
                  • Opcode Fuzzy Hash: 7cf020c578a7a834592f1ec232fb1849c2ff7897a6cc1b4742b28c96be1bda7a
                  • Instruction Fuzzy Hash: ED911430B19A5E8FDB58EF6888655BA77E1FF98300F11457ED41DCB292DE34A901CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8E5050 Relevance: .3, Instructions: 274COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bdf6eb9c284f9e957078b6c37db9cf6276d89848bea88590d8114a52bddcc55b
                  • Instruction ID: 686c0e154e0ee7892939d15cfa2be3313c662ee15705e32537f8c4627ac378b1
                  • Opcode Fuzzy Hash: bdf6eb9c284f9e957078b6c37db9cf6276d89848bea88590d8114a52bddcc55b
                  • Instruction Fuzzy Hash: 46A19570A0E68E4FE769EB6488796F97BF0FF19300F0505BBE408C61E6DA28A544C752
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BDF00 Relevance: .3, Instructions: 269COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ce4bb8d59fe17c589d319507872f9586d26bfb8a0c1a5ab23556501358d44fa0
                  • Instruction ID: 78db092816a636068ba4d1b4e9df04b631c4c24abcba307ed7d69dafdf028bb8
                  • Opcode Fuzzy Hash: ce4bb8d59fe17c589d319507872f9586d26bfb8a0c1a5ab23556501358d44fa0
                  • Instruction Fuzzy Hash: 7291D130A0A65E8FEB95EF74C8685F93BF0FF19301F0149BAD419C71A6DA34A644CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0A01 Relevance: .3, Instructions: 257COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e86388b4f87a77054f677c5240e9441e52a40794fc3e7fa60dc9da8a14b57c1f
                  • Instruction ID: c698836bd2c45c2ed568e8200fff6a0040aff42383a0270ffeea4b303ee829d5
                  • Opcode Fuzzy Hash: e86388b4f87a77054f677c5240e9441e52a40794fc3e7fa60dc9da8a14b57c1f
                  • Instruction Fuzzy Hash: C981A330E2E65E4FE761EB7588696ED7BE0FF09700F0145B6D418C71E6EE38A6448B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B338F Relevance: .2, Instructions: 241COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c7ecaef8cef3c9cf8f45d97077d5dca240711887440ae13d1ff3a9bc4674e3a3
                  • Instruction ID: 2eb48bb51b6416d2d2ece73b5ee3e8b1b738b35855e79c331f7011ed8d8e729e
                  • Opcode Fuzzy Hash: c7ecaef8cef3c9cf8f45d97077d5dca240711887440ae13d1ff3a9bc4674e3a3
                  • Instruction Fuzzy Hash: C181B030A0E69E8FDB56DB7488696BA3BF0FF1A300F0504BBD459C71E2DA39A545CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2998 Relevance: .2, Instructions: 240COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7f0a9546fc0555e25442a1abe737b7c4c748976cacc6bb46550b2f3e17772bb3
                  • Instruction ID: 0be630c265a4a6f4d034b6c59edc1e737785819f13dd7bbe6eb6dd3b7cf1792e
                  • Opcode Fuzzy Hash: 7f0a9546fc0555e25442a1abe737b7c4c748976cacc6bb46550b2f3e17772bb3
                  • Instruction Fuzzy Hash: 48819131E0E65E8FEB65DBB498646ED7BF0EF49300F050176D408D61E2DA38A545CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B35BE Relevance: .2, Instructions: 234COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 31abeba78cb1846f25b2d357e56c171243ca8c02a46d0abc817284e48383faef
                  • Instruction ID: 1cff4ab41d628c66454849fbc069caf43e9852430026382fdd578793314e1770
                  • Opcode Fuzzy Hash: 31abeba78cb1846f25b2d357e56c171243ca8c02a46d0abc817284e48383faef
                  • Instruction Fuzzy Hash: A371B571A1894D8FEB98DB6CD8657ADBBE1FF99350F5002BAD00DD32D6DBB418018B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B05D0 Relevance: .2, Instructions: 233COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c2c6d958a1ec6c4c4c47fce5b5b3fb21745b87d21fd1d229e6ab6c838dad55ce
                  • Instruction ID: 5559eef638d45a15697512df847ac3b8447e14c6362bfc311a97947af5bc4e76
                  • Opcode Fuzzy Hash: c2c6d958a1ec6c4c4c47fce5b5b3fb21745b87d21fd1d229e6ab6c838dad55ce
                  • Instruction Fuzzy Hash: B761F230B19A5E8FDB58EF6888655BA77E2FF98300B14417ED459CB291DE34E902CBC1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC4D5 Relevance: .2, Instructions: 233COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b4e8d63ad377b321e1da453a871790598fe8ba42ef2155cdc1d1990923f3529c
                  • Instruction ID: 5aee79ce414ed05ca14520a2dfecc4448ec40aaa495d0ca92dcf811c2362d10c
                  • Opcode Fuzzy Hash: b4e8d63ad377b321e1da453a871790598fe8ba42ef2155cdc1d1990923f3529c
                  • Instruction Fuzzy Hash: 4671A130E1A64E8FEB51DFA4C8252FE7BF0FF19300F01457AD518C61A6DA38AA45CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B29D0 Relevance: .2, Instructions: 232COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 692545d0d910cf4d1424371a0299166727e8c250bbe281a570438b27a0e9e1b7
                  • Instruction ID: 0c10d52fe72bd9c451d2b40d917ba715c39f119192a0575e4cd2aee58fab6b29
                  • Opcode Fuzzy Hash: 692545d0d910cf4d1424371a0299166727e8c250bbe281a570438b27a0e9e1b7
                  • Instruction Fuzzy Hash: E4819F74A0A64E8FEB65FFA488686FD7BE0FF09314F0105BBD41AC71A6DA38A5448741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBB00 Relevance: .2, Instructions: 222COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5da4a7d773e718330f3b40d5e16d19cfd8cff197e278e9efeae91cf7ce40e864
                  • Instruction ID: 8769783e0a97d70bec315fb6fc5d8000eb26f5fd455dec19d041005b1da0fa91
                  • Opcode Fuzzy Hash: 5da4a7d773e718330f3b40d5e16d19cfd8cff197e278e9efeae91cf7ce40e864
                  • Instruction Fuzzy Hash: 3271503095F7DE8FD7669B7488355E93FB4FF06200F4605BBD458C60E2DA289648CB82
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAAB0 Relevance: .2, Instructions: 214COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 97ae690c90252573ed6ccabf61649a63a066e0e72e0e4b6c503f86fe3ba66fa9
                  • Instruction ID: d5f7afaa75d1e761ba42c1b90843a8bcf8b0a61552552342b7a62c5bb7467ed9
                  • Opcode Fuzzy Hash: 97ae690c90252573ed6ccabf61649a63a066e0e72e0e4b6c503f86fe3ba66fa9
                  • Instruction Fuzzy Hash: BB717130A1E69E8FDB66DB7488796F93BB0FF09300F0505BBD419C60E2DA39A644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B29B8 Relevance: .2, Instructions: 210COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5350eab28496e886bebc509dd7dacd431d739372e1242c2e9d8ede15692c2390
                  • Instruction ID: 2b5e87799b9fc674c92f41b00e73aa4e5c2c6dea4a03839fe6c760348d77c8ad
                  • Opcode Fuzzy Hash: 5350eab28496e886bebc509dd7dacd431d739372e1242c2e9d8ede15692c2390
                  • Instruction Fuzzy Hash: F5618030A1E65E8FEB65DBB488656ED7BF0FF09300F450576D408D71E2EA38AA45CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BDF88 Relevance: .2, Instructions: 199COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9004232522ce60d3a878d5403dce13386fad05ea3b9ff363728a883112cf14f0
                  • Instruction ID: 08b24f6fee75d0843fd1aa54d8fb28d3c1c236ee2ab89d21e0144ae625ff77cc
                  • Opcode Fuzzy Hash: 9004232522ce60d3a878d5403dce13386fad05ea3b9ff363728a883112cf14f0
                  • Instruction Fuzzy Hash: 5F61B930A0E79E8FEBA59F7488252F93BF0FF19301F0545BAD409C61E6DB3896558B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8E5160 Relevance: .2, Instructions: 197COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 13f74c374e47848d9e6b367821e138053ac60ee1cd4db3d03c119722d3cfedd9
                  • Instruction ID: 21685c5fac366dc804995443a7dd505a80aa7c96c1bf5fbb273246ce753285f0
                  • Opcode Fuzzy Hash: 13f74c374e47848d9e6b367821e138053ac60ee1cd4db3d03c119722d3cfedd9
                  • Instruction Fuzzy Hash: D361A671A0E68E8FE759EB6488696F97BF0FF19300F0505BBE40CC71A6DA38A544C752
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B27FD Relevance: .2, Instructions: 190COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a41468571f4315be78b2ea4a62e165e61fdcaba62efe86becfd07592b983931a
                  • Instruction ID: 36f1b38c7825aba498f24bc2f1ed4af8e8e7d38d5310767a4d8db17f195071b6
                  • Opcode Fuzzy Hash: a41468571f4315be78b2ea4a62e165e61fdcaba62efe86becfd07592b983931a
                  • Instruction Fuzzy Hash: 4D5100327096668BD316BFBCF8A58E93B60EF4636570545B7D088CB0A7DE28A047C7C1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B3038 Relevance: .2, Instructions: 186COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c7619cd5d5ad38c529a91183a8a14c6fa7a685c1191bb08d188521d6b45c4c6d
                  • Instruction ID: e94e3d9bc8dcd1039dbfd45555a67c466cc9364ab270b7445d9723ec7169d80a
                  • Opcode Fuzzy Hash: c7619cd5d5ad38c529a91183a8a14c6fa7a685c1191bb08d188521d6b45c4c6d
                  • Instruction Fuzzy Hash: 2B519630A5F39E8FE7629B748C656E97FB0AF4A300F0505BBD444C71E3DA28A649CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD178 Relevance: .2, Instructions: 186COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2d1b2733bcaadca6eba5a53db2e723bc086414c6b66ce8526a50bd980296d03a
                  • Instruction ID: 334067ee06c813fd2a4e086839d4555d76d0048c7ee0ce8ed3a72f4c720e41e5
                  • Opcode Fuzzy Hash: 2d1b2733bcaadca6eba5a53db2e723bc086414c6b66ce8526a50bd980296d03a
                  • Instruction Fuzzy Hash: 1B61843190E79E9FEB569F7488242E97BB0EF0A304F0505BBD454C61E2DA38A654CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4DB0 Relevance: .2, Instructions: 185COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2860cb01bdd40b6153ab5b9848b9db5d7760cb791893ae22f7ad80e9bf5a6474
                  • Instruction ID: d9eed4dc55ca2f289c1ebb4a72527e320c80c1beb093284ce7d7ea9aadfea798
                  • Opcode Fuzzy Hash: 2860cb01bdd40b6153ab5b9848b9db5d7760cb791893ae22f7ad80e9bf5a6474
                  • Instruction Fuzzy Hash: F8513E70E1991D8FEBA4EBA8D459BADB7F1FF58310F45016AD00DE3295CF3469818B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C5B30 Relevance: .2, Instructions: 178COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5ec2b66ef7ea588ded2abd80097c34780866687183b544149b6ea33cdc4db5bd
                  • Instruction ID: 7cd4cb26ee8df14e1962822a4fe18c3589f19a4b8eda89b8d2e0c0a111681779
                  • Opcode Fuzzy Hash: 5ec2b66ef7ea588ded2abd80097c34780866687183b544149b6ea33cdc4db5bd
                  • Instruction Fuzzy Hash: CF6142B0E0A65E8FEBA5ABA488657F976B0FF19301F0101BBD45DD31A2DF3856448B41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC4FB Relevance: .2, Instructions: 178COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8cccc1d226208b106ef51042c798af252e13a38c66f8cd1265133c667cde7db4
                  • Instruction ID: 1acc2e5c23aefc7a942a4cd7a51b08723c4148d01fb0ce54aa7dbab9a02caec6
                  • Opcode Fuzzy Hash: 8cccc1d226208b106ef51042c798af252e13a38c66f8cd1265133c667cde7db4
                  • Instruction Fuzzy Hash: 64518231B0A64E8FDB65EF6898246FD7BF0FF59311F15057BD408D21A2DA38AA44C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B3070 Relevance: .2, Instructions: 173COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ae9969ac97d7f6f98f7eacdbb866792600a7eca6a3bc3af3cacb3dfdc59a12d5
                  • Instruction ID: 2e2ce2d8f5b861539d068972d42f079380e1a28a7840b0bdfe86512cf1be12f8
                  • Opcode Fuzzy Hash: ae9969ac97d7f6f98f7eacdbb866792600a7eca6a3bc3af3cacb3dfdc59a12d5
                  • Instruction Fuzzy Hash: AB519230A1E65D9FE761EB7888596A93BE4FF5D300F0645B7D408C70B2EA34E649CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC4C8 Relevance: .2, Instructions: 173COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f4978f68843299e4bd3234438f6cd8117d77215f8f1f82439e91e1603c2fd562
                  • Instruction ID: 00b2758c4cb3ef0b31100b6366791a6af4c3d3f8b7aeb1b9b38b10c3d40e9b32
                  • Opcode Fuzzy Hash: f4978f68843299e4bd3234438f6cd8117d77215f8f1f82439e91e1603c2fd562
                  • Instruction Fuzzy Hash: E5519230A0A69E9FEB659F74C8246FD7BF0FF19304F0504BAD419C61E2DA38A654CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BB8CA Relevance: .2, Instructions: 171COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 687135fc3d0186e59ae5ed64aabf5e2b82ad343dba75bf289f00d206ca73dc26
                  • Instruction ID: 08dacba743377386cd224b48873ef16479a3d35cb69ce07f500e36b6c5ea41a5
                  • Opcode Fuzzy Hash: 687135fc3d0186e59ae5ed64aabf5e2b82ad343dba75bf289f00d206ca73dc26
                  • Instruction Fuzzy Hash: 78510870E0A65E8EEB68DFA4C4656FD76F1FF09300F11047AD40AE72A1DA356A44CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC4D0 Relevance: .2, Instructions: 167COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1316169146c338127f6942e06c64f2d5cc49e97e967f1bf46ea98c93793bf53a
                  • Instruction ID: b0b25f46be3aaeb6b4cf274391064863bb110f8cd90e2a03cd3948af9d789ab8
                  • Opcode Fuzzy Hash: 1316169146c338127f6942e06c64f2d5cc49e97e967f1bf46ea98c93793bf53a
                  • Instruction Fuzzy Hash: E6518C30A0965E9FEB65EBB4C4686FD7BE0FF1D304F0104BAD419D71A6DA38A644CB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC475 Relevance: .2, Instructions: 165COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 04a1fc7d008513693516ef8b4aa0c5872195995dc22d747416b03de67c5a5bff
                  • Instruction ID: 8b54138b79d4b978765d1ce3a45479331be69867cce367bc8a8d1928caf93778
                  • Opcode Fuzzy Hash: 04a1fc7d008513693516ef8b4aa0c5872195995dc22d747416b03de67c5a5bff
                  • Instruction Fuzzy Hash: 8C519430A0E68E8FDB59EF6488682FD7BE0FF59300F1145BAD819C31A5DB789654C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC6D0 Relevance: .2, Instructions: 164COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f2c4389988be0df9bca70dd8129bca3479361d75b27409eddc9bffb0cd83e486
                  • Instruction ID: a092505ab7ce9d5c154e183ae2384fd63dde43e3634ced9f016f05b68bc0639e
                  • Opcode Fuzzy Hash: f2c4389988be0df9bca70dd8129bca3479361d75b27409eddc9bffb0cd83e486
                  • Instruction Fuzzy Hash: 6351A130E0965E9FEB65EBB4C4696BE77E1FF4D300F1145BAD009C21A5DE38A5468B80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2DA9 Relevance: .2, Instructions: 163COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9b94c95dd79e2cfb6d671d9e58fd8ffc7ffaab0d507428894af5c68d99fe4d1a
                  • Instruction ID: 1557e370f29082a824b56c1e92a2e6ae425919784b47ac9a804d80aab535ce69
                  • Opcode Fuzzy Hash: 9b94c95dd79e2cfb6d671d9e58fd8ffc7ffaab0d507428894af5c68d99fe4d1a
                  • Instruction Fuzzy Hash: 5751A330E1E25E8FE7629FB488296EA7BF0EF09310F054576D418D61E6DA38A644CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B11AD Relevance: .2, Instructions: 151COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 269d1925cad4d5b288ae4a6e96975fe1747b6be2f317e46a7491dbc006feb971
                  • Instruction ID: 36a5e7e8b75b49cfc6255b45fa080f2babefcf541c0ac082514dddd32e2e582d
                  • Opcode Fuzzy Hash: 269d1925cad4d5b288ae4a6e96975fe1747b6be2f317e46a7491dbc006feb971
                  • Instruction Fuzzy Hash: E851C231A1A65E4FEB55EBB8C8696F97BE0FF19300F0100BED019DB1E6DE256944CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBBC8 Relevance: .1, Instructions: 149COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4e395a02e58b2b4457488b60014f4f556171916d855e14455c96208a18d53289
                  • Instruction ID: 2e91b0b8861f7df164a12a9af2ec4d04ab3f6fccd91bc10459f4ec9157a20684
                  • Opcode Fuzzy Hash: 4e395a02e58b2b4457488b60014f4f556171916d855e14455c96208a18d53289
                  • Instruction Fuzzy Hash: 1A51543095E79E8FD7669B7488791F93FB0FF0A300F4605BBD858C60A2DA289658CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC675 Relevance: .1, Instructions: 147COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d5eefc61d0cdf26eaad5eb40d0f55ca1b9e452d7c828deb8e1da775e9ceef357
                  • Instruction ID: 403ebe6f1e3b71391cd939a3dbe66e1c5aaf722da9672a1e4abdd83a348a5002
                  • Opcode Fuzzy Hash: d5eefc61d0cdf26eaad5eb40d0f55ca1b9e452d7c828deb8e1da775e9ceef357
                  • Instruction Fuzzy Hash: 18518670E0E24E8FDB65EBA4C8256FE7BF0EF09300F11057AD409D71A2DA38A654CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAAA8 Relevance: .1, Instructions: 146COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8bc309dcfdfd1f97004a9c01a36bb218e3a554e8a547a2e6fe49b5d77b8c3062
                  • Instruction ID: 0a1053d8bd070ba7f6cd42fa92fb6cac193cc73c7d372b883321bf174c17c768
                  • Opcode Fuzzy Hash: 8bc309dcfdfd1f97004a9c01a36bb218e3a554e8a547a2e6fe49b5d77b8c3062
                  • Instruction Fuzzy Hash: 5E41753091E79E8FD7669B7488391F93FB0FF0A300F4605BBD858C60A2DA389654CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC53D Relevance: .1, Instructions: 139COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1a3a09ae77a83760e9dc05b582daf6fb37209cdf3deb42850e68517cf8bfe4a1
                  • Instruction ID: b334183f0f48d3ad186a4624c864f028e66afd82389d7f1f6d8bc96b3f7a916e
                  • Opcode Fuzzy Hash: 1a3a09ae77a83760e9dc05b582daf6fb37209cdf3deb42850e68517cf8bfe4a1
                  • Instruction Fuzzy Hash: 4741FC2270E66A4FE756A7B8EC398FD3F60FF4A324B0501B7C058C60E3D91865458F91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BB404 Relevance: .1, Instructions: 124COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0391b52dbeb4d14142dc4cbc7a89259a9ecd1bdf7149ef7165b89190938af2c
                  • Instruction ID: a6c04627c14110feaa14f02d4b44a01361e9a35c2f5fb8e7658f62ba25f992c1
                  • Opcode Fuzzy Hash: e0391b52dbeb4d14142dc4cbc7a89259a9ecd1bdf7149ef7165b89190938af2c
                  • Instruction Fuzzy Hash: 7E51CC70E1552E8EDBA8DFA4C8657EDB6B1FF58300F1145B6D40DE22A1DE346A85CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD228 Relevance: .1, Instructions: 124COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0d34385a29b3fb9ed421a24ad5c24840cc3f57e74334cf55604e56c47e38a2f
                  • Instruction ID: 16cce6dfa5b1b0201d1e57be3a6ce7c785b57dc28c0894ca61798020b0026be0
                  • Opcode Fuzzy Hash: e0d34385a29b3fb9ed421a24ad5c24840cc3f57e74334cf55604e56c47e38a2f
                  • Instruction Fuzzy Hash: CE419431A0E69E9FEB659F7488242FD7BA0FF09304F0505BAD418C61E2DA38A654CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBC50 Relevance: .1, Instructions: 121COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eff7f4ca53752ecc6aebd31b83a4e0417159926fc07daefd7cb828286a1fe121
                  • Instruction ID: f242cc75ee47c1aba4d45baf423758299cd19a9433b347811eb1c15aef14680a
                  • Opcode Fuzzy Hash: eff7f4ca53752ecc6aebd31b83a4e0417159926fc07daefd7cb828286a1fe121
                  • Instruction Fuzzy Hash: B0415430A5E69E8FD752DB7488695E93BF4FF09300F4645BBD418C70B2DA28A644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC02F Relevance: .1, Instructions: 120COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 996771e783a56b837cd9352990420c32ac1a77367d2d81e08ba2212cfce8a676
                  • Instruction ID: 07aab64032f6951c0795c5cf7246336208e57fd35de071aee39f86002e07aa50
                  • Opcode Fuzzy Hash: 996771e783a56b837cd9352990420c32ac1a77367d2d81e08ba2212cfce8a676
                  • Instruction Fuzzy Hash: 3541943094E3DA4FDB569F7058295E63FB0EF0A214F0601FBE458C64A3DA2C565ACB92
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA8D8 Relevance: .1, Instructions: 120COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 994edda9a8dd1c9d3975aab8b9deb6a9f0853c449a19780d400de7ace6374f1e
                  • Instruction ID: 1ff17ae92e94d942440443ae3814343d532b1ff6cb9c5a608a76aadcc3a57e8d
                  • Opcode Fuzzy Hash: 994edda9a8dd1c9d3975aab8b9deb6a9f0853c449a19780d400de7ace6374f1e
                  • Instruction Fuzzy Hash: AD417E70A5A64E8FEB95EFA4C8696BA7BF0FF19300F0104BBD41DC71A2DA34A644C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B11C0 Relevance: .1, Instructions: 119COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a257f068827602449dbe2dfb1d868bdb430991a15b2c30db5ee8df3dafc70669
                  • Instruction ID: fdb7480e2be244c10992efb0dca3d0e61fa5a7dc4990733960dd7f866f8aff92
                  • Opcode Fuzzy Hash: a257f068827602449dbe2dfb1d868bdb430991a15b2c30db5ee8df3dafc70669
                  • Instruction Fuzzy Hash: 5F31D331E1A6AE4FEB64EBB8C8256F977E0FF59310F05007AD019D71E6DA2469448B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAB58 Relevance: .1, Instructions: 116COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7838004743ac825b83e2b72817cd8eb7b31fd76f007c358f9b5ec2e16de1ae78
                  • Instruction ID: 5842f9a110769fe764d40550cd10c667465a3b553431136243bb7e3588eb65d4
                  • Opcode Fuzzy Hash: 7838004743ac825b83e2b72817cd8eb7b31fd76f007c358f9b5ec2e16de1ae78
                  • Instruction Fuzzy Hash: 2A31E730A0E55E5FE761EB7888695ED7BE1FF09300F4645B6C418C70B6EE38A6448B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC495 Relevance: .1, Instructions: 112COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 63f93c4d6d53ecbb0a33724256db956cfe9624db2f1d196a05570d2fe07b8f21
                  • Instruction ID: e9456fd9aeead1add92de344affd1fe4e4a7d28820e38422fab551320e37e8d2
                  • Opcode Fuzzy Hash: 63f93c4d6d53ecbb0a33724256db956cfe9624db2f1d196a05570d2fe07b8f21
                  • Instruction Fuzzy Hash: 3831A030A0960E8FDB59EF68C4696FA3BE0FF5C304F51057EE419C21A5CB35AA50C780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBC48 Relevance: .1, Instructions: 111COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 75345275f09d97af79d5a1f4065f2f5e9e32f041ca9ee4a0ba0bbd22a2aece36
                  • Instruction ID: 44267d67cdb547c675b7701edf5d67ba14f063798c6d00c41801dbb8ff118763
                  • Opcode Fuzzy Hash: 75345275f09d97af79d5a1f4065f2f5e9e32f041ca9ee4a0ba0bbd22a2aece36
                  • Instruction Fuzzy Hash: B831553095F79E4FD7629B7488355E93FB0FF09200F4605BBD454C60A2EA289658C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBE48 Relevance: .1, Instructions: 107COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8aa356d49a1a28e92d37111511ae0c084577fbe74c0f136ffd85c61a7e30c264
                  • Instruction ID: eee099fb40ba68772cae77b81e8603dad924084db98ee6f758642fc4e21abad6
                  • Opcode Fuzzy Hash: 8aa356d49a1a28e92d37111511ae0c084577fbe74c0f136ffd85c61a7e30c264
                  • Instruction Fuzzy Hash: DF31EE70E1992D9FEBA4EBA8D8A5AACB7B5FF5C300F51503AD00DD3262DE3469418F40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBCC0 Relevance: .1, Instructions: 100COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cfff959a4efe849b77c5fb3861140f2c93e81ba4dd2e1c6ed28c144e0ccdf154
                  • Instruction ID: bbb7152ac218f506d7a4bab34c3b591b8722e3081273af596ba977ecceee3ca4
                  • Opcode Fuzzy Hash: cfff959a4efe849b77c5fb3861140f2c93e81ba4dd2e1c6ed28c144e0ccdf154
                  • Instruction Fuzzy Hash: 65317E30A1A69E8FD756EB7488696F97BF0FF19300F0604BBD419C70A2DA38A644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B3148 Relevance: .1, Instructions: 96COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 326a63da4c808ca71905584f16dfc45f44ca9ef430f189fad41dcc47ab70c396
                  • Instruction ID: 25097e21d9cfcc5ffc5857952ff5ea73756910cf99404d1b42f0fe1f76696797
                  • Opcode Fuzzy Hash: 326a63da4c808ca71905584f16dfc45f44ca9ef430f189fad41dcc47ab70c396
                  • Instruction Fuzzy Hash: 79318F30E1A65E8EE765DBB4D8646EE7AF0FF49300F45057AD409D71E2DA38AA04CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BDC7C Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 02a14fc52e65682b791f97a083de5a0631640ce3d94d37e2a646e1712daa5bcd
                  • Instruction ID: 21f6116f8eb95a9a0c6f7001cbd1de5d6023bbf17c3d689f36b25dfeed078736
                  • Opcode Fuzzy Hash: 02a14fc52e65682b791f97a083de5a0631640ce3d94d37e2a646e1712daa5bcd
                  • Instruction Fuzzy Hash: 36310E70E1966E9FEB68DFA0C8A46AD77B1FF58300F01017ED449976A2CB786941CF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC990 Relevance: .1, Instructions: 83COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2e5e88348b6337e123adf3c56a2639d28ed13ff0968e7e058eccfe28c8fd4b78
                  • Instruction ID: 2191ec854e6e85ace0c001007c6cbc1a42ef36ff46179ac938090d92f8a3ad2a
                  • Opcode Fuzzy Hash: 2e5e88348b6337e123adf3c56a2639d28ed13ff0968e7e058eccfe28c8fd4b78
                  • Instruction Fuzzy Hash: 7321B97190E68D4FE752EFB848681B97FF0FF1A300B4604FBD458C60E7DA24A5548351
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA908 Relevance: .1, Instructions: 83COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c3fe6265517534b2912a8c05085b05903a16cf274aeb1fb48ff466c1810dbf8a
                  • Instruction ID: fc878363ff8d43de94ab718c80d6c310079c75da48931566352809f2318b9da6
                  • Opcode Fuzzy Hash: c3fe6265517534b2912a8c05085b05903a16cf274aeb1fb48ff466c1810dbf8a
                  • Instruction Fuzzy Hash: F721AC30A1E68E8FEB65ABA4C8286BA37B1FF09700F06017BD40DD71A1DB786A54C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC6AD Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6327fd2e4f89e1607a748e97eb18fb4dde8ce8cb848c44f8a4479de47110c2b1
                  • Instruction ID: dd29832c592662f9281ef85fb3dde5835920f01ff0a8c2317431612fe0a613c2
                  • Opcode Fuzzy Hash: 6327fd2e4f89e1607a748e97eb18fb4dde8ce8cb848c44f8a4479de47110c2b1
                  • Instruction Fuzzy Hash: EF215170E0921E8FEB65ABA4C8286FE77F4FF09300F11457AD419E71A1DB38A644CB51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBCB8 Relevance: .1, Instructions: 76COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: af45276ed98f72d416bb9fba4b7708d8b309c8ba71cc8d3ff7191307705452ec
                  • Instruction ID: a2aa1806ad7d1f0a9cbb93f5b06c0bdf77a7d15fad9ad66eccc2f34fafd6314b
                  • Opcode Fuzzy Hash: af45276ed98f72d416bb9fba4b7708d8b309c8ba71cc8d3ff7191307705452ec
                  • Instruction Fuzzy Hash: 4821743095F79E4FD7629B7488356E93FB0FF0A200F4605BBD454C60A2EA28A648C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B04F8 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1f67d2015eb83bc3c0b7277aec6c96292452e94ef56f622ba2a68bc62e9950de
                  • Instruction ID: af68170e794ab36f489ef79c635085e7e453335f236229e9e1e18d65c59838aa
                  • Opcode Fuzzy Hash: 1f67d2015eb83bc3c0b7277aec6c96292452e94ef56f622ba2a68bc62e9950de
                  • Instruction Fuzzy Hash: 2A21B330A1A64E8FEB55EFB4C8686A93BE0FF09304F0109BAE419C71B5DA38A154CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B26A9 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0b267c72481868c6fb57d6a3ea5e2a44f1a0c60518f4b36e60852fd741db0eae
                  • Instruction ID: 44d67f38e7420f788ce15e9ecd1870c5fafcae889b111291fa2704f3981fa0b5
                  • Opcode Fuzzy Hash: 0b267c72481868c6fb57d6a3ea5e2a44f1a0c60518f4b36e60852fd741db0eae
                  • Instruction Fuzzy Hash: 1321D43091E78E8FDB569FB488642A93FB0FF0A304F0505BAD418C61E2EA38A504CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1F29 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 89ab027e159544c2b48fa3b81a373a7267bce0501e2f90422f1051e9fc51d132
                  • Instruction ID: e546497d6ff2cbe3b12312bddeea780a1acedcbffcb81b10f4ab20038bc83299
                  • Opcode Fuzzy Hash: 89ab027e159544c2b48fa3b81a373a7267bce0501e2f90422f1051e9fc51d132
                  • Instruction Fuzzy Hash: 41119E11A6F2D65EEB3363B848714657FA44F07224B2E46FBD0D88E1E3DA085946C782
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B31B8 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0f587f32109ff96a3413495081cb2fccef5f816a6b00c11f657e7fcf0b49442
                  • Instruction ID: 146fdb2e4f562eb90239d763a3866cbc5ae40c3ca0fe85471521042537919e8a
                  • Opcode Fuzzy Hash: e0f587f32109ff96a3413495081cb2fccef5f816a6b00c11f657e7fcf0b49442
                  • Instruction Fuzzy Hash: 6D213E31E1A61E8AEB65DFB4D8646ED76F0FF49300F51053AD009E32E1DE38AA448F91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B05D8 Relevance: .1, Instructions: 60COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ce4ec98800dd8f9402d8e9cca7096004f08c1c67842bd71a46c28863d9d187d2
                  • Instruction ID: 79420eb77a9ec780cc492a4ef77c242adb85e32f950355e50a50ee3e9851c8fb
                  • Opcode Fuzzy Hash: ce4ec98800dd8f9402d8e9cca7096004f08c1c67842bd71a46c28863d9d187d2
                  • Instruction Fuzzy Hash: 2D110130A5A61E8FDB64EF74C4759BA37A1FF49300F1140BED409CB0A6CE35A651CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAA78 Relevance: .1, Instructions: 54COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6e4866bf216b3ffbc465285b96365e39a4ca73cafa9b9e187472c49f6e088263
                  • Instruction ID: e5c1ab5e724ee4da6b21eb7e25da0de76bc9585497657fb9b9177778dce7c953
                  • Opcode Fuzzy Hash: 6e4866bf216b3ffbc465285b96365e39a4ca73cafa9b9e187472c49f6e088263
                  • Instruction Fuzzy Hash: CD11E130A0960E8FDB59DF74C4695BA3BA1FF0C304F5144BED419C60A5DB386244CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC080 Relevance: .1, Instructions: 54COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 01afba6e81b5a9c40c07def804a3c6c886d906319f685b9b5f5fb9d2c9f3c561
                  • Instruction ID: bfcb127d6aed1d870e0f2cf8829e86058449839ccf8721fe94c04bc0c41e75ba
                  • Opcode Fuzzy Hash: 01afba6e81b5a9c40c07def804a3c6c886d906319f685b9b5f5fb9d2c9f3c561
                  • Instruction Fuzzy Hash: 7A118C30A0968E8FDB95EB7488285BA7BF0FF09304F0104BFD419C71A2DA346645CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBD28 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 68db4b44c32ffd3d6433f3ddbfd79e83e410efdf64560962d7fe82613fba8ab6
                  • Instruction ID: 9b72d5d5c987d20d5e41569dfb91982c30fe2f4ccf919e4d55f5a0e429ac6381
                  • Opcode Fuzzy Hash: 68db4b44c32ffd3d6433f3ddbfd79e83e410efdf64560962d7fe82613fba8ab6
                  • Instruction Fuzzy Hash: 3001713090E79E4FDB569B7488251FD3FB0FF0A200F0605BBD418C70A2DB7856448B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3cb3d2b9ea95d4126d4383287d00905720b8643bf93e9d304bd87ba8b5e2540d
                  • Instruction ID: 7850bd92735747f346537c4a89b544435cefc8c571db142e4aa37380d4fdd2f9
                  • Opcode Fuzzy Hash: 3cb3d2b9ea95d4126d4383287d00905720b8643bf93e9d304bd87ba8b5e2540d
                  • Instruction Fuzzy Hash: 9401A230A1550E8EDB58EFB4C4686B977A0FF08304F10087ED41EC21E4DE35A140CE44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 18805990dd15b6890b9989d5dc4e7d0fffc755b7583c28009c519718776f8e42
                  • Instruction ID: 879d7ab9188aa621a113b5319476f9458c1369c1ff74d41e410a23eb0c2eba60
                  • Opcode Fuzzy Hash: 18805990dd15b6890b9989d5dc4e7d0fffc755b7583c28009c519718776f8e42
                  • Instruction Fuzzy Hash: 39016D30A1551E8AEB59EFB4D4686B97AA0FF18304F51087EE41EC61E5DE35B250CE44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAAB8 Relevance: .0, Instructions: 40COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 470e763ffbf99698f2eeaa2011a81b248e881a2d683958b8138bb9eae73bdfa1
                  • Instruction ID: c358c134d0da782565caf6d029e9a654bf608db6a88e0da4126c740d5223ed40
                  • Opcode Fuzzy Hash: 470e763ffbf99698f2eeaa2011a81b248e881a2d683958b8138bb9eae73bdfa1
                  • Instruction Fuzzy Hash: 22014F3091A79E8FDB569B7488252F93BB0FF0A200F0605BBD418C20A2DA386654CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC0F8 Relevance: .0, Instructions: 40COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9f591eba36ed08fc5c44ac6316c56017e1d896db353fc4a724e583d8025a4a14
                  • Instruction ID: 4ed865eefb60fd9e235b92db0873531d2e1008309bf319d8e7c3221e2a2394b8
                  • Opcode Fuzzy Hash: 9f591eba36ed08fc5c44ac6316c56017e1d896db353fc4a724e583d8025a4a14
                  • Instruction Fuzzy Hash: FC01623490E69E8FDB659F7484691EA3BA0FF09310F4144BAD418C60A2DB389654CF81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B278D Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6a3bf5646f3c0ccd902dcfeef2363a089253ff6f71e7f2404a76c1af5007bad9
                  • Instruction ID: a6af49fbbbe53b801dd1e75097bac5511b65fea8b37b557f0669cbc9bf174ee8
                  • Opcode Fuzzy Hash: 6a3bf5646f3c0ccd902dcfeef2363a089253ff6f71e7f2404a76c1af5007bad9
                  • Instruction Fuzzy Hash: D4F09630A0E79ECFDB699FB488251A93FA0FF09600F4505BED419C61E6EB389554CB86
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD0F1 Relevance: .0, Instructions: 32COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9fa637aabedf48070a959fc2fd6373fb4e53698295c43440f3c7d2c0f1229c56
                  • Instruction ID: 81a3a1c047845a6413db7f4ad063d58219616d5bdc84defad3c9c06293847b62
                  • Opcode Fuzzy Hash: 9fa637aabedf48070a959fc2fd6373fb4e53698295c43440f3c7d2c0f1229c56
                  • Instruction Fuzzy Hash: EFF0D030E1D51E9FEB74DBA4D4A5ABEB7B5EF5D310F25013AD00AD32A1CA3466428F80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1710 Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction ID: 0e94d10f5f9d83330b4ce44dc32aa82d3ed6b65e4dfc00f44764df6c3b581516
                  • Opcode Fuzzy Hash: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction Fuzzy Hash: D8E0E520F2A91A8AE77473AC849567571D19B4C354FBA8675F01CCE3F1DB2CDD81CA81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B22E1 Relevance: .0, Instructions: 22COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ee42e0146269bb3355a337735680fb168d02b093ad2358445ab4b5feab393eb4
                  • Instruction ID: f1566f07f853c2811576e109d8251791396ab35461115e676453568cf706ddb7
                  • Opcode Fuzzy Hash: ee42e0146269bb3355a337735680fb168d02b093ad2358445ab4b5feab393eb4
                  • Instruction Fuzzy Hash: 9DF0A231A0952DCBEB64DF50C854BADB3B5FB54301F0185BAC44DD71A1DE746A848F50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B840E Relevance: .0, Instructions: 16COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f2589abc030683be89b61c89ca2e3a9ce70112d005d4a3745be90ccc275e386c
                  • Instruction ID: dd570f5ee9917aab27d2f6caa97a351e3fe978a77e367a065c7d403df8a69754
                  • Opcode Fuzzy Hash: f2589abc030683be89b61c89ca2e3a9ce70112d005d4a3745be90ccc275e386c
                  • Instruction Fuzzy Hash: 13E0B67091982E8FDBB4DF6888647BD77A0EB5C301F1104B9800DD7290DE346A818F90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 00007FFD9B8B8033 Relevance: 2.7, Strings: 2, Instructions: 168COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: v$x
                  • API String ID: 0-775512
                  • Opcode ID: 23963076b1083151a1c10caccccacbf64044fbe0ea3104e5144e029730362806
                  • Instruction ID: fc6a10d09d4a422f7c29059ce297629dd6d454ac1302df69ade5256780dc6350
                  • Opcode Fuzzy Hash: 23963076b1083151a1c10caccccacbf64044fbe0ea3104e5144e029730362806
                  • Instruction Fuzzy Hash: 8081B371E152298FDBA4CF68C891BDDB7F1FB48300F0486A9D41DE7251DB38AA858F51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B9993 Relevance: .6, Instructions: 625COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 892549c7553751a5907aca7daf4c3a08f56f1989af5190b483c9041ce0c2d1a3
                  • Instruction ID: cb5a7bf0c229d298c1d34a7b06ff42c29f623722f0459e9e60b446de79b479ec
                  • Opcode Fuzzy Hash: 892549c7553751a5907aca7daf4c3a08f56f1989af5190b483c9041ce0c2d1a3
                  • Instruction Fuzzy Hash: 8322813190E7DA8FDB529F7488695E93FB0EF1B310F0A05EBD444CB1A3D6289958CB52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA8ED Relevance: .3, Instructions: 300COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 29af62ff912ae29c26d7f373d0eeb77a88665f120a74db7de8c5a789dfd788ab
                  • Instruction ID: d6c6ce0a7f3ae8a98f14c94b32815e7ec92f40cfdd02c8d27f07c7a1faeba38f
                  • Opcode Fuzzy Hash: 29af62ff912ae29c26d7f373d0eeb77a88665f120a74db7de8c5a789dfd788ab
                  • Instruction Fuzzy Hash: DBB1B070A0A68E8FDB59EF64C8A56F93BF0FF19300F4105BBD419C61A2DB38A655C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA880 Relevance: .2, Instructions: 234COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eba1d97f8e95f045ca510e668ee8afedfc8173ce52f47645551b46fe7bcc186b
                  • Instruction ID: dae369c612e66a15178aaa48c29281bb942908dfe077b0189a569e2bca399ee7
                  • Opcode Fuzzy Hash: eba1d97f8e95f045ca510e668ee8afedfc8173ce52f47645551b46fe7bcc186b
                  • Instruction Fuzzy Hash: 0C719C30A1A64E8FDB9AEF64C8695BA7BE0FF19304F1145BFD419C31A6DB38A604C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BE204 Relevance: 7.7, Strings: 6, Instructions: 238COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$9$S$[$`$e
                  • API String ID: 0-1713107869
                  • Opcode ID: c0852e226c6a11abb21e67959b2f1bc73eec9a5f7b939aff9c2d072bf1be58a3
                  • Instruction ID: 1e637832af009f605e8ba88417103535d9b430808b71bd8df4066f6b3a4bf720
                  • Opcode Fuzzy Hash: c0852e226c6a11abb21e67959b2f1bc73eec9a5f7b939aff9c2d072bf1be58a3
                  • Instruction Fuzzy Hash: 6CB1C670E0966E8FEBA8DF64C8A47E9B7B1BF58301F1045E9D40DA76A1CB745A84CF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BF025 Relevance: 5.1, Strings: 4, Instructions: 51COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1721709009.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_7ffd9b8b0000_J7XIGd3DCJ.jbxd
                  Similarity
                  • API ID:
                  • String ID: L$P$_$u
                  • API String ID: 0-601783657
                  • Opcode ID: 445c6ed3a3e47a46efbfda455c94fd84224b8f03e83c6db17cd55afd08f44aa9
                  • Instruction ID: 955c9a9cfdacdda1ef5b6d4ab4e84baf83142cf9e39b9686ea3d6e7ed0aabef8
                  • Opcode Fuzzy Hash: 445c6ed3a3e47a46efbfda455c94fd84224b8f03e83c6db17cd55afd08f44aa9
                  • Instruction Fuzzy Hash: DB21B974E0922A8FEBA8DF54C8A47B9B7B1BF18301F0141BED00EA6690CB345A84CF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 00007FFD9B8A2075 Relevance: 1.4, Strings: 1, Instructions: 146COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: H
                  • API String ID: 0-2852464175
                  • Opcode ID: 84837d32297af805bd1dd339bc010274895d82b29818969852d059d997e52c9b
                  • Instruction ID: 2d4a921a5a67f5c33c381e69f472e374a20942b8cd354983117f619da5b4e31b
                  • Opcode Fuzzy Hash: 84837d32297af805bd1dd339bc010274895d82b29818969852d059d997e52c9b
                  • Instruction Fuzzy Hash: 09415731B0EA4A0FE765DBB888655B97BE0EF49350F0545FBD00CC71E3DE28A9428351
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AD5F5 Relevance: .4, Instructions: 388COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 63f8c469b555dead9235aa56d91a7b25ba439656bd0744f8c9f331857c74b565
                  • Instruction ID: 0bb559878a98d2e76e2856da616485232f1259cc4a8a37aa160a4f71a49adcec
                  • Opcode Fuzzy Hash: 63f8c469b555dead9235aa56d91a7b25ba439656bd0744f8c9f331857c74b565
                  • Instruction Fuzzy Hash: 8AE14B71E1965D8FEBACDB98D8A4BB8B7B1FF58300F0441B9D01DD32A2DA346941CB51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A16A8 Relevance: .3, Instructions: 286COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9d8737454138b86e00c460eb79fd98bcbb685d8389d8bd5ccac50fe2552bf3cd
                  • Instruction ID: 49954c152101f72349935401da9ff107fa398bbdc76bfcfb047dda085b694873
                  • Opcode Fuzzy Hash: 9d8737454138b86e00c460eb79fd98bcbb685d8389d8bd5ccac50fe2552bf3cd
                  • Instruction Fuzzy Hash: 2981D131B0DA494FDB58EF5C88615A977E2FF9A300B15467EE45DC3292DE34AD02C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A35BE Relevance: .2, Instructions: 215COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dd976f089b816d74e82f316a1bf310a4922a018a332aef717624620058a932c5
                  • Instruction ID: d3346c5ae63ed3f904acdac608a911609dece9e75d2e328cd529017ac98f0e04
                  • Opcode Fuzzy Hash: dd976f089b816d74e82f316a1bf310a4922a018a332aef717624620058a932c5
                  • Instruction Fuzzy Hash: 6B71A671A1894D8FEB98DB9CD8257ACBBE1FF99350F5001BAD00DD32DADBB518018741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC87A Relevance: .2, Instructions: 194COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 698129ee18ec336e2774c9cc9bb278930aba8b8b00ac12ce5582cd70c50811f5
                  • Instruction ID: 33fcdf41ea9e0fe03a33bcb0342749e91b069a1ee8e52fd84c4e560f8f96e066
                  • Opcode Fuzzy Hash: 698129ee18ec336e2774c9cc9bb278930aba8b8b00ac12ce5582cd70c50811f5
                  • Instruction Fuzzy Hash: B5512732B0D52E8AE725FBA8E8695FD77A0FF09315F04057BC019C60E3EE3461468B91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1C5D Relevance: .2, Instructions: 194COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37dd5aa0821e50f994ab4af71b36a9fb8fd4ca073c38065601f4753262ee8bd0
                  • Instruction ID: 0d7e19430b4374da6447b3a1e260c7e9480f48e1bb30c24e0bc5a61b9e4c15a8
                  • Opcode Fuzzy Hash: 37dd5aa0821e50f994ab4af71b36a9fb8fd4ca073c38065601f4753262ee8bd0
                  • Instruction Fuzzy Hash: 2B51E131B09B4D8FDB58DF5888A45BA77E2FF99300B15467ED45AC7292DE34E802C780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4DB0 Relevance: .2, Instructions: 185COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 588a3c6c1c55b5d6e3e3a0324cf24cda76f61809e8fade8fd21577af6e2ca4e9
                  • Instruction ID: c57d89719080cda5330038055d0574d42b32c50dbe8213a54e4610a175c469be
                  • Opcode Fuzzy Hash: 588a3c6c1c55b5d6e3e3a0324cf24cda76f61809e8fade8fd21577af6e2ca4e9
                  • Instruction Fuzzy Hash: 6C514F70E1991D8FEFA4EBA8D899BADB7F1FF58310F45016AD00DE3295DE3469418B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A17C0 Relevance: .2, Instructions: 163COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 29a1222cd7ac312201b265a9b7e43a21772fe480983ab57bae38d26df6d8327d
                  • Instruction ID: 4ceb40c00b7c8f23d4c3d8a84f7173c0501531eddd654effe723bf03f330f581
                  • Opcode Fuzzy Hash: 29a1222cd7ac312201b265a9b7e43a21772fe480983ab57bae38d26df6d8327d
                  • Instruction Fuzzy Hash: 86418D30B18A4D8BDB5CEF4888656BA73E2FB99305B14467EE45ED3295DE30E912C780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A31A1 Relevance: .1, Instructions: 145COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c7f9658be12c37bf9ea814c0337ff99cb23601d4a9b35d2fe914b5817d0c2c81
                  • Instruction ID: 32fbe77ae2a3f527b827422139fd8bb9da439a1d45959de7dd4877251a617791
                  • Opcode Fuzzy Hash: c7f9658be12c37bf9ea814c0337ff99cb23601d4a9b35d2fe914b5817d0c2c81
                  • Instruction Fuzzy Hash: 83512B70E0A51D8FEB64EB94D4646EDBBF1FF59301F41017AD009E72A1DA38AA45CB10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC4FB Relevance: .1, Instructions: 140COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0b425fce4008c305293678f6e1cc9146c049d40a5222152de2ad7874c615247e
                  • Instruction ID: 418e36ea092d2310782461fe64e3fa4bb9bd2b54d7ef076168bbf62cfa8ff7eb
                  • Opcode Fuzzy Hash: 0b425fce4008c305293678f6e1cc9146c049d40a5222152de2ad7874c615247e
                  • Instruction Fuzzy Hash: 43412262B0D62A8AE72A7BECBC294FC3794FF49335F050077E109C60D3ED68A14586A1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AB404 Relevance: .1, Instructions: 128COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e5e7f6ebfa29f56eb2de9c91da67a08280526d6ec3d8d1cd9dced7b78d6c0634
                  • Instruction ID: b1f47fded710df2b382fe85080c353581efc343838c10e5bda09857655e0d1d4
                  • Opcode Fuzzy Hash: e5e7f6ebfa29f56eb2de9c91da67a08280526d6ec3d8d1cd9dced7b78d6c0634
                  • Instruction Fuzzy Hash: 9B510670E1951E8FEBA4EF94C8657FDB6B5EF58300F1041BAD40DE22A1DA346A818B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ABE48 Relevance: .1, Instructions: 108COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5ab4b66991834603cec1253bd4da9c9c345078f0f9491a442618c65f4629772d
                  • Instruction ID: d6882d27a6074bf9de0cb1698e38857e9dcb6040e4328fa17129dcdca1234aac
                  • Opcode Fuzzy Hash: 5ab4b66991834603cec1253bd4da9c9c345078f0f9491a442618c65f4629772d
                  • Instruction Fuzzy Hash: 2931E670E1991D8FEBA4EB9898A5AACB7B5FF5C300F51103AD00DD32A2DE3469418B10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ABEC0 Relevance: .1, Instructions: 93COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0301a2e72281eaabb2352608f92ecbe53fe6872c8f83e1ee660ef725d6f0ea2e
                  • Instruction ID: 7557129a1c44a327a9316a70d3c5e8fd34a19b7b4fe5f774e7e3f0a5dd25265a
                  • Opcode Fuzzy Hash: 0301a2e72281eaabb2352608f92ecbe53fe6872c8f83e1ee660ef725d6f0ea2e
                  • Instruction Fuzzy Hash: 57212870E1995D8FEBA4EBA888A56BCB7F5FF5D300F55113AD00DE32A2DE3469418B10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC91D Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7b768b8a0ce7f779be9aeb5147e35ba1232ce2060cbc75310c865ea781832518
                  • Instruction ID: bf045a6ad3003fbffc002b904363188708b6fbc05b630be76b269b9343131a42
                  • Opcode Fuzzy Hash: 7b768b8a0ce7f779be9aeb5147e35ba1232ce2060cbc75310c865ea781832518
                  • Instruction Fuzzy Hash: F6212732B0892A8AE355BFBCF8191F977A0EF44326B044577C05CC6097EA38A1868791
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ADC7C Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dffbd67ff8842f59cdad232bd4cfb6692e053ca607724481c4b19a9568e5f0b5
                  • Instruction ID: abaf83d463f82cfbc4c0973c0f38426e731c30a8b5f5059a14cfa8279a96abae
                  • Opcode Fuzzy Hash: dffbd67ff8842f59cdad232bd4cfb6692e053ca607724481c4b19a9568e5f0b5
                  • Instruction Fuzzy Hash: 68311A70E1965E8FEB68DB90C864BADB7B1FF58300F4101BAD449A76A2CB786941CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AAB58 Relevance: .1, Instructions: 85COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f98a70748c91fcf639cbc9f0bfc2cae7a0422c895f397539a341593c49d1ce06
                  • Instruction ID: 8b0c9790d45b890843ed768a5b428c6109700c34a92da4481512f846d5cce598
                  • Opcode Fuzzy Hash: f98a70748c91fcf639cbc9f0bfc2cae7a0422c895f397539a341593c49d1ce06
                  • Instruction Fuzzy Hash: 0B21B030B1A90E5EEB61EBA8C8585FD77E2FF5D300F4649B6D41CC31B6EE34A6448650
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A338F Relevance: .1, Instructions: 80COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7793e321af27cad4f66c6dea69acd26800392944ae1f6708281731764977fc11
                  • Instruction ID: 3a0e89e350475c01448821cf737e0472a69ef8c25f2459f358664cd3944a5ca9
                  • Opcode Fuzzy Hash: 7793e321af27cad4f66c6dea69acd26800392944ae1f6708281731764977fc11
                  • Instruction Fuzzy Hash: A721A13194E7CA4FD743ABB488685A93FF0EF5B300B0944EBD449CB0B3DA29954AC721
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A32D2 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f3865dbb23d6271e16cdc8f919144afb1f40e5fc76161c0bebc4f2226b0690e2
                  • Instruction ID: 15800a82039c4708eb20f9a2cd64f2cfa7f0d29679688f2a6c9049b43d78910b
                  • Opcode Fuzzy Hash: f3865dbb23d6271e16cdc8f919144afb1f40e5fc76161c0bebc4f2226b0690e2
                  • Instruction Fuzzy Hash: 5D21F470E0961D8FEB64EF98D4A4AECBBF1FB98301F554179D009E72A5DE386940CB20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A3535 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7b601cdc886a8d7db2ac7ba0638f28ed60fea1960555eaa69a30e6177b5c7e4a
                  • Instruction ID: ca249f1410bcd2425350b58fba993dc89368f78d04a66c2d3f6a8df22bd8910b
                  • Opcode Fuzzy Hash: 7b601cdc886a8d7db2ac7ba0638f28ed60fea1960555eaa69a30e6177b5c7e4a
                  • Instruction Fuzzy Hash: A9218E30A0A64E8BEBA9DBA8C8257F937A0FF59304F01047AD01EC21E1DF78A504C721
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0A01 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7c55e7fa5f41ade27a4aff8c34879868a9a0d6bace57191f6e2d49724c186894
                  • Instruction ID: fb19c9cf3acf458cd402408d67255987d7a80a74ec8f9c242882a5aa4f6e323a
                  • Opcode Fuzzy Hash: 7c55e7fa5f41ade27a4aff8c34879868a9a0d6bace57191f6e2d49724c186894
                  • Instruction Fuzzy Hash: 3111BF30E2A90E4FEBA0EBA8C8695BD77E1FF58740F4146B6D01CC70A6EE34B6448710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1F29 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 864a2ad63e93e0c3ff2a7e09c60ae489f61e8702c46c74a781f4805094f2d2d0
                  • Instruction ID: 06aa505cddc1106ddf1bfaa219f9abc3b05deb0d85ecb2931e88b91720b6a01c
                  • Opcode Fuzzy Hash: 864a2ad63e93e0c3ff2a7e09c60ae489f61e8702c46c74a781f4805094f2d2d0
                  • Instruction Fuzzy Hash: C3117C11A4F6C65EEB3367B948744656FA45F07224B2E46FFD0D8CB0E3DA0C598AC322
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC5C0 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0630fda3d81a4442b29503a361009c9643c6be359e7760801ee5c33c66061a1b
                  • Instruction ID: 35ff5170b39adedef7d62cfc3cfa78b2ce4c57297211f329eb65085c6710c99a
                  • Opcode Fuzzy Hash: 0630fda3d81a4442b29503a361009c9643c6be359e7760801ee5c33c66061a1b
                  • Instruction Fuzzy Hash: 12116A30A0A64E8EEB5AEF64C8685B93BA0FF19304F0105BAD419C60A2DA78A644CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ABD15 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: df567ede08fc82620a2a56e6312b9a31e824dd4053cbdb31ef619269974aec55
                  • Instruction ID: 3b4a81efebc4fab2d8546c39a0bbb64183f917414fdef9bd7b23f012bddb7b24
                  • Opcode Fuzzy Hash: df567ede08fc82620a2a56e6312b9a31e824dd4053cbdb31ef619269974aec55
                  • Instruction Fuzzy Hash: 39115E30A4AA4E8FDB55EFA8C8A96FD7BF0FF19301F4105BED419C61A2DA35A650C710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A11AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 311501b585617ea3fd5c03dd721a350b1664e7209b12a8b993eb57bd0481c1c3
                  • Instruction ID: fa8273d38996b51e00bd49830b7424592931f0187800bfe6071ef4018faa7fc7
                  • Opcode Fuzzy Hash: 311501b585617ea3fd5c03dd721a350b1664e7209b12a8b993eb57bd0481c1c3
                  • Instruction Fuzzy Hash: 5D11B230E0E64E4FEB65EBA4C4796B97BE0EF5A304F0104BED41AC61E1EE295640C710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A34B5 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 102507011767c6544d5236b8bdfbbb7d23a45a25339eab904501a1259962a872
                  • Instruction ID: 8ade328a99f10e7b96eb7c27234c061804b9b281dd75b778472b0339b3fe7925
                  • Opcode Fuzzy Hash: 102507011767c6544d5236b8bdfbbb7d23a45a25339eab904501a1259962a872
                  • Instruction Fuzzy Hash: DC115230A0A64E8FDB55EFA8C8695BE7BF0FF19304F0105BED419C71A1DB35A5448710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC0E9 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 792b2239f68309ad63921c5a789900b3002f5743f0ad2192d796dfbf4a9e94f3
                  • Instruction ID: ca67992b5fe5acd242218ed7256b78c7b7fecbffb9c7f291d9910c4453b5ed03
                  • Opcode Fuzzy Hash: 792b2239f68309ad63921c5a789900b3002f5743f0ad2192d796dfbf4a9e94f3
                  • Instruction Fuzzy Hash: 7411CE30A0A68E8FDB59DF64C8691B93FE1FF1D300F5200BED419C61A2DA35A654CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A05D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2abf4c1ef368e4c5f32852ac12d855c84f9dcbb8019e24396d0c3a97a6a83013
                  • Instruction ID: 4499aa67f83fe41874c307a3719e1e954e22892f83d939cf523929425281bb7e
                  • Opcode Fuzzy Hash: 2abf4c1ef368e4c5f32852ac12d855c84f9dcbb8019e24396d0c3a97a6a83013
                  • Instruction Fuzzy Hash: E8019E30A0A50E8FEB68EF64C0646BAB7A1FF5A304F11007ED40EC31A4CE36A690CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AB8CA Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 97b4087790334bf9ca747b9a9bbe054cafd8ad02acf32df543afcbdf654717bf
                  • Instruction ID: 87d94f628972e06735923738e75fc1e24558869f46533acd429bd1f1b99dc15b
                  • Opcode Fuzzy Hash: 97b4087790334bf9ca747b9a9bbe054cafd8ad02acf32df543afcbdf654717bf
                  • Instruction Fuzzy Hash: B6018030A0AA0E8EEB94EF68C4A82BD77E0FF1C304F01057ED41EC21A1DE75A640C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A27FD Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3025198d06d7aded392dd27972679971d57f978fb739df6ada2c09b74c55d8eb
                  • Instruction ID: 38e3f3e31b32390420f364cc704f21b265cbe1dbe99e2c0856ddba22494d9d9a
                  • Opcode Fuzzy Hash: 3025198d06d7aded392dd27972679971d57f978fb739df6ada2c09b74c55d8eb
                  • Instruction Fuzzy Hash: 9B01D430A4A64E4FE761EFA888995B97BE0FF1D300F0245B6E40CC60A6EE38E5448710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AA6D9 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ef93939d1161517d82e1ea0a7b1bcc05e0efb8cf216882b887dca954be400cf3
                  • Instruction ID: 89f22b9391f8dc8d4f933c4fd52c9427fd370997db6ccc388f81e6bf876634fb
                  • Opcode Fuzzy Hash: ef93939d1161517d82e1ea0a7b1bcc05e0efb8cf216882b887dca954be400cf3
                  • Instruction Fuzzy Hash: 0301B530A4E64D9FD762AB7488685A97BF0EF09300F0649B7D448C70B2EA38A5448711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A2E99 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cbb46e048e9b15512ee5cf1e13925080b50033c6226ed949db92fb006be5c076
                  • Instruction ID: a118de390d430fbcde87b83c52cde4613dad8582bfd2a869d088cfa99a2d4168
                  • Opcode Fuzzy Hash: cbb46e048e9b15512ee5cf1e13925080b50033c6226ed949db92fb006be5c076
                  • Instruction Fuzzy Hash: 7C018430A0E64D4FD762EBB489595A97BE0EF4A300F0645B7D40CCB0B7DA38A6948721
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1BDD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e3d1ae342a83fddf85d409cba808018c40db26b630125665acdad1ee9c85eaaf
                  • Instruction ID: 643ea21a3789acc4c1125d2e574c4479dd81ef2bc9aa2c19591954ef22fb8b13
                  • Opcode Fuzzy Hash: e3d1ae342a83fddf85d409cba808018c40db26b630125665acdad1ee9c85eaaf
                  • Instruction Fuzzy Hash: A801A230A0E68E8FDB65EF64C8655B97BA1FF5A300F45017ED808C61A2DB759690C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2f0a7c0fb03786efeb51d5460262337013a7766539b42b03d1754f29c1616e47
                  • Instruction ID: c474b277964dd80b0bb486bd36dec8e0bd5580a27f84563216cf2d03cf08ea24
                  • Opcode Fuzzy Hash: 2f0a7c0fb03786efeb51d5460262337013a7766539b42b03d1754f29c1616e47
                  • Instruction Fuzzy Hash: 46016230A1550E8EDB68EFA4C4686B973A0FF18305F51087ED41EC21E5DE35B650CA10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8d684504ecaec64f47054515c4d5abbadf7f6b93dd9b8b9535b68abfefc99d38
                  • Instruction ID: a4b1b2879c4dee8bca2ddb8650c4b3e721dc9d5dbad6ed83fc360e9d09ed3538
                  • Opcode Fuzzy Hash: 8d684504ecaec64f47054515c4d5abbadf7f6b93dd9b8b9535b68abfefc99d38
                  • Instruction Fuzzy Hash: BC018130A1550ECAEB68EFA4C5686B973A0FF1C304F51087EE41EC61E5DE35B650CA10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A05D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0acc2a38a9f4bc55b8d37bbd578b8aec40ba526228fe741d226889711c959715
                  • Instruction ID: 54721f135a3ba2ef84f85573fc451abf4b816d3509da5e349dfe23f774716508
                  • Opcode Fuzzy Hash: 0acc2a38a9f4bc55b8d37bbd578b8aec40ba526228fe741d226889711c959715
                  • Instruction Fuzzy Hash: 21F0C830A0A50E8FEB64EF6494255FA77A0EF0A308F01007AE80DC30E1DE75A650C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A11C0 Relevance: .0, Instructions: 38COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 49258d9587c7d56f02a697ff4907ef514c4dc0d6c58a59f17b1ea214103af35c
                  • Instruction ID: 0d78a35850abef11b8e2b2fc910e85b2be1c97b66acf2b7b8932fd4a0d2894fd
                  • Opcode Fuzzy Hash: 49258d9587c7d56f02a697ff4907ef514c4dc0d6c58a59f17b1ea214103af35c
                  • Instruction Fuzzy Hash: 1DF0C230E1A65F4AFBA4EBE498792F977E4FF5A304F00147AE42EC20E1EF285654C650
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A278D Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6d68daee40d4b0aa9feec762fda9762a6b7df11f91ef99b7f4f089543aa6ce6f
                  • Instruction ID: 408207c76a1cb2d53dfde7e9b8363e4c32c125f467d7017e30c0cc420df01e98
                  • Opcode Fuzzy Hash: 6d68daee40d4b0aa9feec762fda9762a6b7df11f91ef99b7f4f089543aa6ce6f
                  • Instruction Fuzzy Hash: 69F0F630A0E78ECFDB699F6488241A93BA0FF09600F0105BED809C60E2EB38A640C711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A2719 Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7347d05924421bf7d56123789fafeffb70827bb64fa9025f2eac9c5c7d8e2835
                  • Instruction ID: ce4389100f030cf7b6ca40728ee2da195e3125058edb33662fc8308fe75ff02c
                  • Opcode Fuzzy Hash: 7347d05924421bf7d56123789fafeffb70827bb64fa9025f2eac9c5c7d8e2835
                  • Instruction Fuzzy Hash: FCF0963050E38D8FDB699F6488642E93B70FF06304F4515FAE819C61E6DB38A654C751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1710 Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction ID: b9ac0fc198507bde863b3500a176d862d3809c50e884dc35ce3aae6bd9f3babe
                  • Opcode Fuzzy Hash: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction Fuzzy Hash: 62E0E520F0A94A4AEB747358849557471D19B4A314FBA8675F01CC61F1DB2CDD81C711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A840E Relevance: .0, Instructions: 16COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9551d37fecec1d886a8772acdd6f3c4cfac57c1c289fafff7bf6b2244c3c4fe0
                  • Instruction ID: f2ce770c51e17f930cc00a9f02ab315ea8ea59c985c3e67c96d4dd05a9f00832
                  • Opcode Fuzzy Hash: 9551d37fecec1d886a8772acdd6f3c4cfac57c1c289fafff7bf6b2244c3c4fe0
                  • Instruction Fuzzy Hash: 29E0B67090981E8FDBB4DB5888A47AD73B0EB58301F5114F9810ED7290EE305A828F60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0FB9 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000D.00000002.1780818759.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_13_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 492e6ff0eb3b835d187fd2092c72c69a49376a3e4297b23d05091f42e4f9394c
                  • Instruction ID: e36ea7d930fb2261b3a5618fbbd496278c9d8bab75bd20e083df5df7f861dc2e
                  • Opcode Fuzzy Hash: 492e6ff0eb3b835d187fd2092c72c69a49376a3e4297b23d05091f42e4f9394c
                  • Instruction Fuzzy Hash: 74E0EC20E1681D4AEB98EB54DC60FADA6B1EF58304F5041B5D00DA3296DE346E854B54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 00007FFD9B8BE2B6 Relevance: 2.5, Strings: 2, Instructions: 41COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: Z${
                  • API String ID: 0-2824158054
                  • Opcode ID: f28d5e8a5e899d2e2e2e1cf5b0a4d0d43a38718fff6f7805789981a35f70ef63
                  • Instruction ID: 4948da8f45f182e5622024a8f970645c476a2b5fea005e040400084670126799
                  • Opcode Fuzzy Hash: f28d5e8a5e899d2e2e2e1cf5b0a4d0d43a38718fff6f7805789981a35f70ef63
                  • Instruction Fuzzy Hash: DB111F70D4866E8FEB64DF14C8A43E9B7B1BB18302F1105B9D00DA26A0DB785BC0CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C5D30 Relevance: 1.3, Strings: 1, Instructions: 51COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: "
                  • API String ID: 0-123907689
                  • Opcode ID: 44f1746b001c48f20981ea2ebbbf108a1c98b503dcb6f43f1ab3b5d62b71e65a
                  • Instruction ID: 3c9d8fcc1d6fefaec89b83eefe2e8f39d03c1b20496924022a2cb84803aedd7e
                  • Opcode Fuzzy Hash: 44f1746b001c48f20981ea2ebbbf108a1c98b503dcb6f43f1ab3b5d62b71e65a
                  • Instruction Fuzzy Hash: 331199B0E0952D8FEB69EB94D8647FCB6B1FB58301F1141BAD409A3291CB785A84DF04
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C2E88 Relevance: .5, Instructions: 514COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f5697a781c9b837c3e3946366204fc44570f39ce8ad9b71afcbb86e78de288a9
                  • Instruction ID: e5b7fe701b46dc721fa887c7c2b33a27bdd88f7a8ccaaf7e623e011525b12f53
                  • Opcode Fuzzy Hash: f5697a781c9b837c3e3946366204fc44570f39ce8ad9b71afcbb86e78de288a9
                  • Instruction Fuzzy Hash: 6C41F962A0F6DA4EE762BBB898761E97FE0FF16314B0941F7D098CB0E3D92465458341
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C2EFA Relevance: .5, Instructions: 455COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e8157ddfce64dacffbf7f711036c5991fb8f0adcaa1f68448da4ef87e233e9d2
                  • Instruction ID: 6ca200031d3e705c1464488623d48656dbbcd89d7998a782a94cfa357940fb4e
                  • Opcode Fuzzy Hash: e8157ddfce64dacffbf7f711036c5991fb8f0adcaa1f68448da4ef87e233e9d2
                  • Instruction Fuzzy Hash: D61166A190F7CA5EEB66ABB44C661B47FB0EF17205F0904FBD498C70E3E92869548342
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BD5F5 Relevance: .4, Instructions: 388COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5a6d8b795e2bc03c2c567b6bbb5fecc7dc963801fecc5e4954be02d1cdbfbaca
                  • Instruction ID: d9a62223a02eec62f79ae776eacb448711258655dda1e80c651e9f97300d8e7c
                  • Opcode Fuzzy Hash: 5a6d8b795e2bc03c2c567b6bbb5fecc7dc963801fecc5e4954be02d1cdbfbaca
                  • Instruction Fuzzy Hash: 33E14C71E1965D9FEBA8DBA8C8A47A8B7B1FF58300F0441BDD01DD72A2DA346941CF41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C3755 Relevance: .3, Instructions: 303COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f616d4a6ab5f9e0d34c7ea8a800114278d870b22eb02cef53247373c6a11cc94
                  • Instruction ID: f7651fc2e232201910ea3014fee444dd08491ce06b877bbe653480428a18ad9b
                  • Opcode Fuzzy Hash: f616d4a6ab5f9e0d34c7ea8a800114278d870b22eb02cef53247373c6a11cc94
                  • Instruction Fuzzy Hash: 30C1A6B0E1962D8EDBA4EBA8D8657ECB7B1FF58301F1141BAD00DE3291DF745A858B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B16A8 Relevance: .3, Instructions: 285COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5e566d860a51bc498d180e5b6a6900929d881dee6a23e2d4c31a3a9f8ca7054b
                  • Instruction ID: c564a8dbba4732fdfc4634a42082a60a02eb6cb672eb89ee0dd39dfd0a7f3db9
                  • Opcode Fuzzy Hash: 5e566d860a51bc498d180e5b6a6900929d881dee6a23e2d4c31a3a9f8ca7054b
                  • Instruction Fuzzy Hash: E381F031B1DA594FDB58EF6C88715A977E2FF98300B15017EE45DC72A2DE34A9028B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B35BE Relevance: .2, Instructions: 215COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6cfbf2d900b896082a443c96c013b62651c4faf5589c92e79006b204a58da769
                  • Instruction ID: 391ad959b5e9956a1399a56e77dcc4bc16b0d21730a313b97f4c06e034b70be5
                  • Opcode Fuzzy Hash: 6cfbf2d900b896082a443c96c013b62651c4faf5589c92e79006b204a58da769
                  • Instruction Fuzzy Hash: 1C719671A1894D8FEB98DB6CD8657ADBBE1FF9A310F5002BAD00DD32D6DBB418018B41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1C5D Relevance: .2, Instructions: 194COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 949c135f6e301fe67c3a79dc63c4700461fc181d49f74b790869b58a3463ba0c
                  • Instruction ID: 0cc1e417c36a58583f161833fb8bf9dd9ec82280f572300ae21686c10323863e
                  • Opcode Fuzzy Hash: 949c135f6e301fe67c3a79dc63c4700461fc181d49f74b790869b58a3463ba0c
                  • Instruction Fuzzy Hash: 72510331B19B5D8FDB58DF5888615BA77E2FF98300B14417ED45ACB292DE34E8028BC1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4D9D Relevance: .2, Instructions: 193COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d853a3d9f5cff7e07c4609418fa3dea5282ec1e41e9e5e27fa9a5d20f04c4bed
                  • Instruction ID: 6565a1c775a9f68328a8fdcc7703ff7f141f6b5cc5cd8bc99217ba6537a5ffb9
                  • Opcode Fuzzy Hash: d853a3d9f5cff7e07c4609418fa3dea5282ec1e41e9e5e27fa9a5d20f04c4bed
                  • Instruction Fuzzy Hash: 6C515070E19A1D8FEBA4EBA8D855BACB7F1FF58310F45016AD00DE7292CF3469818B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C35FA Relevance: .2, Instructions: 183COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 95d795677697c5951e7719ca8cc31bc65c3ab56762e58a6403d76f0655990d28
                  • Instruction ID: e28a0cbe559defe0439b12cb2d493d770a92b7b69337832a7dbf2fcb5c8c7993
                  • Opcode Fuzzy Hash: 95d795677697c5951e7719ca8cc31bc65c3ab56762e58a6403d76f0655990d28
                  • Instruction Fuzzy Hash: EE41597370E55D5EF721BBADFCA99E9BBA0FF8037AB040777D148C6052D920944A8390
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4DB0 Relevance: .2, Instructions: 168COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 733275949658e6405dc64454d8b84f17f6c6a3a18efdfebb54c75fbe03ea6ed5
                  • Instruction ID: fbf53f060cb073176a1c3b1b75a7c99b686a634412c61323fe431100f80c51ee
                  • Opcode Fuzzy Hash: 733275949658e6405dc64454d8b84f17f6c6a3a18efdfebb54c75fbe03ea6ed5
                  • Instruction Fuzzy Hash: 9A513C70E1991D8FEFA4EBA8D859BADB7F1FF58311F41016AD00DE3296DB3469818B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2075 Relevance: .1, Instructions: 146COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6f9e9b04cb9634b5e3e4dda3f6c1ea3d0bbdf2a311be6637112aec2c3bc7dc0b
                  • Instruction ID: 84a8ccfd7afc7153f3683fcc0d10d2930b69d61b71cd6f4483ea7c28638bb094
                  • Opcode Fuzzy Hash: 6f9e9b04cb9634b5e3e4dda3f6c1ea3d0bbdf2a311be6637112aec2c3bc7dc0b
                  • Instruction Fuzzy Hash: AF415931B0E66A0FE756DBB898655B97BD0EF49310F0544FBD00CC71E3DE28A9428781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B31A1 Relevance: .1, Instructions: 145COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 250d0ec264b45657741a51441faec9ec89d2ce69f57a0da7722783cfa98f2e64
                  • Instruction ID: 3ab5fa31593d0a4f632e4d661b7386fe28c3ec47392d960d789e49196ccbd94f
                  • Opcode Fuzzy Hash: 250d0ec264b45657741a51441faec9ec89d2ce69f57a0da7722783cfa98f2e64
                  • Instruction Fuzzy Hash: D5510C31E0952D8FEB64DBA4D464AED7BB1FF49300F410176D009E72A5DA38AA458B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC4FB Relevance: .1, Instructions: 137COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 49d72cf491c7a68a035b0e007157aabe928333562f42a038d605905683f66ca2
                  • Instruction ID: 490ef19c7383bade151d5dd4586bb7cb04ea8fe773d4cdd8481b8fa6c2760912
                  • Opcode Fuzzy Hash: 49d72cf491c7a68a035b0e007157aabe928333562f42a038d605905683f66ca2
                  • Instruction Fuzzy Hash: D0412462B0E67A4AE71A77BCBC288FC7B50FF49339B050177D11DC60D3EE58A1458A90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BB404 Relevance: .1, Instructions: 124COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fc43e719661f3a02c4988164b0cd88a0affcc3427d43cd4245365dbf9e6d1239
                  • Instruction ID: fe0018062920714b5e692ebe2e25ffdd1424f23469518e5c64335f574488f319
                  • Opcode Fuzzy Hash: fc43e719661f3a02c4988164b0cd88a0affcc3427d43cd4245365dbf9e6d1239
                  • Instruction Fuzzy Hash: D251BC70E1552E8EDBA8DFA4C8657EDB6B1FF58300F1145B6D40DE22A1DE346A85CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBE48 Relevance: .1, Instructions: 108COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2b343f75a53d6162205255dd3b007c352f7cba5dc6ff2a89bfbbc7583b70b06c
                  • Instruction ID: 3af2c7b5482933620bdaf5d8b133ce0f04146de9fb066d9f42627c4d10d6031b
                  • Opcode Fuzzy Hash: 2b343f75a53d6162205255dd3b007c352f7cba5dc6ff2a89bfbbc7583b70b06c
                  • Instruction Fuzzy Hash: 1331EE70E1992D9FEBA4EBA8D8A5AACB7B5FF5C300F51503AD00DD3262DE3469418F40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBEC0 Relevance: .1, Instructions: 93COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 42feb5c575fd30fdbb6bd6ebf2a31b3a79c22c2eb491dfed18c4e5ff5458d1ee
                  • Instruction ID: 222e920e7d440393e7966afd977d972081f40a645e6aa9d79677ee4f17995f4f
                  • Opcode Fuzzy Hash: 42feb5c575fd30fdbb6bd6ebf2a31b3a79c22c2eb491dfed18c4e5ff5458d1ee
                  • Instruction Fuzzy Hash: 4D212D70E1992D8FEBA4EBA898656ACB7B5FF5D300F41113AD00DE32A2CE3469418F40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C6955 Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c1359f45bbf828ebba830771ebb6ad12e17062449da25fa0c84b6a4b2e61e298
                  • Instruction ID: c49b28631bf4032bcaf231c52faa38af13d8b1ace53fcc5933bbeda65285e52e
                  • Opcode Fuzzy Hash: c1359f45bbf828ebba830771ebb6ad12e17062449da25fa0c84b6a4b2e61e298
                  • Instruction Fuzzy Hash: 0C31B1B0A0AA4E8FEBA8EF68C4652BD37A1FF68301F11057BD41DC31A6DE34A6548741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BDC7C Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 02a14fc52e65682b791f97a083de5a0631640ce3d94d37e2a646e1712daa5bcd
                  • Instruction ID: 21f6116f8eb95a9a0c6f7001cbd1de5d6023bbf17c3d689f36b25dfeed078736
                  • Opcode Fuzzy Hash: 02a14fc52e65682b791f97a083de5a0631640ce3d94d37e2a646e1712daa5bcd
                  • Instruction Fuzzy Hash: 36310E70E1966E9FEB68DFA0C8A46AD77B1FF58300F01017ED449976A2CB786941CF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C7245 Relevance: .1, Instructions: 88COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8a0fd257a34f3ea5a063fc493a9000bd32234067dd0e18bf57f277c1600c2db3
                  • Instruction ID: 3518ac4552d47b07365290a307347ed418f1f27a996ffdbf1beae067eb7ef500
                  • Opcode Fuzzy Hash: 8a0fd257a34f3ea5a063fc493a9000bd32234067dd0e18bf57f277c1600c2db3
                  • Instruction Fuzzy Hash: 4321FD74A0A64E8FEB75AFA0C8242FD77E0FF09310F02057BD80AD21E1DE38A6448741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BAB58 Relevance: .1, Instructions: 85COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 398dd13c758ff64e980400346cb8c6ab1b30ff12155a4bb29720a2204cd7b4c1
                  • Instruction ID: a535a9d5af5d24d9ebcddb415b597a7ce9d5aac9c79f26c53fcd84cac700d38e
                  • Opcode Fuzzy Hash: 398dd13c758ff64e980400346cb8c6ab1b30ff12155a4bb29720a2204cd7b4c1
                  • Instruction Fuzzy Hash: A4219530A1A91E5EEB61EBB8C8695BD77E1FF5D300F424576D42CC31B6EE34A6448A80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C6A8D Relevance: .1, Instructions: 84COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bcee82f8eeaf74c2c8046a967e89dd0c064eb59a97849fe0acf7f61362f01cbd
                  • Instruction ID: efb7f5e24627f43744de4e9322a62206427382dbba95aaa0f720d4a275644f4b
                  • Opcode Fuzzy Hash: bcee82f8eeaf74c2c8046a967e89dd0c064eb59a97849fe0acf7f61362f01cbd
                  • Instruction Fuzzy Hash: E621F3B0B0E54E8BEB69AF64C8762B937A0FF68300F0181BBD41DC70E6DE3565558741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C6FC1 Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4e6909a52544dae0943328fa726b5d4bc400216fe3968d29b74690f8a789d63d
                  • Instruction ID: c6de67cc81a7e5af5e914260f94e8962dd5adcd9bdd5fe0b822b886be14d4a0d
                  • Opcode Fuzzy Hash: 4e6909a52544dae0943328fa726b5d4bc400216fe3968d29b74690f8a789d63d
                  • Instruction Fuzzy Hash: 38217C75E1E51E8AEBA1EBA888256FE77E0FF1D310F010476D40CD30A6EE28A6148B41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B338F Relevance: .1, Instructions: 80COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e8ade1fbe6aadaf017e658b730c2aa23aab29a85201235359d0e66368472b4db
                  • Instruction ID: 8fae49b80f4a82f57576d583b8d152ec37f618894837613e42c0be12fce5841b
                  • Opcode Fuzzy Hash: e8ade1fbe6aadaf017e658b730c2aa23aab29a85201235359d0e66368472b4db
                  • Instruction Fuzzy Hash: 4C21A13194E7DA4FD7439BB488685AA3FF0EF5B300B0A44EBD449CB0B3DA29954AC751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B32D2 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a46833d5c18ce63b6ac63fc9e15da9496a15cfa3c64aae5596842e33c077c689
                  • Instruction ID: 62482ed9541643609a627e9b17a981c793f3d9eeddfe4eb0e7b8257c245398f0
                  • Opcode Fuzzy Hash: a46833d5c18ce63b6ac63fc9e15da9496a15cfa3c64aae5596842e33c077c689
                  • Instruction Fuzzy Hash: DA210571E0952D8FEB64EBA8D4A4AEDBBF1FF58301F11012AD009E72A1CA386940CF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C70D1 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dfc01c105e5a943570b8ba73942a34ea79102b19e0ab38cf113b4bb7e0652d45
                  • Instruction ID: 4277d1f19631010383527fd42820ca0ac6076c5af8a5d621bc00f412e4bb55be
                  • Opcode Fuzzy Hash: dfc01c105e5a943570b8ba73942a34ea79102b19e0ab38cf113b4bb7e0652d45
                  • Instruction Fuzzy Hash: DD215B74A0A50E8FEBA5EFA4C8696BE77E0FF18304F01047BD41DC61A1DE35A6508741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B3535 Relevance: .1, Instructions: 76COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6e0e1df05851ff01aa2db3e7de8aa50382960416383f05f24fa5a02c24b780d6
                  • Instruction ID: 04c5183fbe1732c6668906abe800154dc572b8c1a977d517bbfda1fe2c52b4ee
                  • Opcode Fuzzy Hash: 6e0e1df05851ff01aa2db3e7de8aa50382960416383f05f24fa5a02c24b780d6
                  • Instruction Fuzzy Hash: 98218030A0A65E8BEBA9DBB4C825BF937E0FF59300F01057AD01ED21E6DF38A5048B41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA191 Relevance: .1, Instructions: 75COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e80d68601a4bd6d3f669975e405487aa78452708c75d4f1ac140a5254b04f336
                  • Instruction ID: 7b024ae4af9ef88e69d8f92546456d49abaf536f511a9f99c25d382cb4004903
                  • Opcode Fuzzy Hash: e80d68601a4bd6d3f669975e405487aa78452708c75d4f1ac140a5254b04f336
                  • Instruction Fuzzy Hash: 1D216F30A1464D8FCB85EF68C455AA93BE0FF2D305F01416AE41AC7265DB34A540CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C7769 Relevance: .1, Instructions: 71COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6bdd83ef8e88a8d73b227fc58717198fe1ed870906a98404d2d0659bbf2e107b
                  • Instruction ID: 5254127e25cca4533b0fe30871d4daa99eb5a302c506087a883cd03be9b2a2b7
                  • Opcode Fuzzy Hash: 6bdd83ef8e88a8d73b227fc58717198fe1ed870906a98404d2d0659bbf2e107b
                  • Instruction Fuzzy Hash: 4F219F74A0A64E8FEB69AF64C8656BD37A0FF09304F2104BBD41DC61E2DE38A650C701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0A01 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3cd56c762afb19465e75066ddd5cc6fa0bcb1adfeb55c57da98f56ae05565f2b
                  • Instruction ID: eaa321e36cb8a06642842c8b4b628cf197c3eb1534069984bdc4c90b64242d86
                  • Opcode Fuzzy Hash: 3cd56c762afb19465e75066ddd5cc6fa0bcb1adfeb55c57da98f56ae05565f2b
                  • Instruction Fuzzy Hash: 9411B230E2A51E4FE791EBB888695BD77E1FF58740F4159B6D018C70A6EE34A6408B80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C2D99 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5960a9fbc78ba7b50442ac9bd766d8e2480573374c31d16e705b1dc38842f56c
                  • Instruction ID: 24a3b3c13645802d8beeedad4f6045fce8ccf50e9939c454b2ac1805967f3458
                  • Opcode Fuzzy Hash: 5960a9fbc78ba7b50442ac9bd766d8e2480573374c31d16e705b1dc38842f56c
                  • Instruction Fuzzy Hash: 2A21C37090E68E4FE752EBA488689FA7FF0FF1A300F0505B7E458C70A3DA289554C751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C71D9 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1808ab3d9de8e20f16b70cda4c195933b7ec9fd5acefc3ed24bdc7aa1221910c
                  • Instruction ID: af588b78db0a8e7c53435fe52f3c3552d548d02d5280e013d0fe01b9c6835541
                  • Opcode Fuzzy Hash: 1808ab3d9de8e20f16b70cda4c195933b7ec9fd5acefc3ed24bdc7aa1221910c
                  • Instruction Fuzzy Hash: 02218E74E0A64E4FEB66BF6488696BD7BE0FF0A300F0214B7D41DC60A6DA38A6448601
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1F29 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 89ab027e159544c2b48fa3b81a373a7267bce0501e2f90422f1051e9fc51d132
                  • Instruction ID: e546497d6ff2cbe3b12312bddeea780a1acedcbffcb81b10f4ab20038bc83299
                  • Opcode Fuzzy Hash: 89ab027e159544c2b48fa3b81a373a7267bce0501e2f90422f1051e9fc51d132
                  • Instruction Fuzzy Hash: 41119E11A6F2D65EEB3363B848714657FA44F07224B2E46FBD0D88E1E3DA085946C782
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C42F5 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 671bf3c75ce0987f2e8325c21296f47889ee82463b87cadfffe80e09fce4884c
                  • Instruction ID: 1c6b73f2858c24d6357fce802238381c753682bdcc9ff3644b9d38ae575e415d
                  • Opcode Fuzzy Hash: 671bf3c75ce0987f2e8325c21296f47889ee82463b87cadfffe80e09fce4884c
                  • Instruction Fuzzy Hash: 5A119370A0964E8FDB98EF6884656B97BA1FF58300F1505BFD41DC71A2DA34A580C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C68B1 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0ec3053d0bf8b9248bb3e1d56333aa3cbe1ae9994a033ce74fbef856a59a3e10
                  • Instruction ID: fca480c33a1c4fc4f7acdd3eaeafc64ccd38e7c2f9d495c57783de5ae9274bc9
                  • Opcode Fuzzy Hash: 0ec3053d0bf8b9248bb3e1d56333aa3cbe1ae9994a033ce74fbef856a59a3e10
                  • Instruction Fuzzy Hash: 6011AFB0A09A4E8FEB98EF6884692B97BE0FF28300F1105BFD41DC31A2DE35A144C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4259 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e43c9f728dac25c57f326133ddbde12ec5ee00c3d51e56acd7a5a55a0f0fe6c8
                  • Instruction ID: c87613d652179367449b4c5c8cde4c415de9e673f37ed63ca29c7f7bb566560d
                  • Opcode Fuzzy Hash: e43c9f728dac25c57f326133ddbde12ec5ee00c3d51e56acd7a5a55a0f0fe6c8
                  • Instruction Fuzzy Hash: 6F21D570A0A64E8FDB59EF6884662B97BB0FF69301F0505BFD41DC71A2DA346584C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4795 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 15d6f371b33e572e6dab4f5eab9f7d4e2897c5ed51185b761304910a4173d7a6
                  • Instruction ID: 33e17ac4588cd4fff90cad4a1c8f6b282c6163bd7e97ec02be0b73a4416f3199
                  • Opcode Fuzzy Hash: 15d6f371b33e572e6dab4f5eab9f7d4e2897c5ed51185b761304910a4173d7a6
                  • Instruction Fuzzy Hash: 3A11C8B1A0EA8D8FEB59EF6488752B83A90FF19304F1905BFD05DC65E2DA656580C701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C20B1 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f4de2b1b578b1d1d9ecd8920571d749f6b39ecc86c07102cdb549efce5f2b79e
                  • Instruction ID: 0ec7042c51cafc26f5dda7ba7dfb8e0cf4fbe64f437598c9882256e825a09edf
                  • Opcode Fuzzy Hash: f4de2b1b578b1d1d9ecd8920571d749f6b39ecc86c07102cdb549efce5f2b79e
                  • Instruction Fuzzy Hash: 3E116A70A0968D8FDB58EF68C4A65F97BA1FF59304F02027EE849C3191CA34A550CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C69F5 Relevance: .1, Instructions: 64COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 286ca00e97d5ec9fc71c693fde14c1199cba99549541c5ff8e7ead9db840c51d
                  • Instruction ID: 7b063def5e3ea6589840c793bc9066eeda1cdfdf9fd6c530b8ef6162da49835e
                  • Opcode Fuzzy Hash: 286ca00e97d5ec9fc71c693fde14c1199cba99549541c5ff8e7ead9db840c51d
                  • Instruction Fuzzy Hash: 7711B6B1A0EA4D4BDB69EFA488B55B83BE1FF29300F0641BFD41DC71A2DE256554C701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4B09 Relevance: .1, Instructions: 62COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1756899dbfd5050d69afac8cfce65f54521512f7e315facebc8ee312b3d166f4
                  • Instruction ID: c21c19bd0b47e3b651c87fbcedfab5302672dff2ab7ee1d88de7429cabdc93cb
                  • Opcode Fuzzy Hash: 1756899dbfd5050d69afac8cfce65f54521512f7e315facebc8ee312b3d166f4
                  • Instruction Fuzzy Hash: 0F118E70A0A64E4FEB99EBA488696B97BB0FF19301F0505BFD41DC71A2DE3465808751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C7051 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 26c162942a1aa00aeb504879b8b184c5a1fbf8488db1a47caaf1a4f086a16ec4
                  • Instruction ID: 84351a45c52e8a75eaa2cfbd4d8054fefa6a5494633292c5df7731c99e94533d
                  • Opcode Fuzzy Hash: 26c162942a1aa00aeb504879b8b184c5a1fbf8488db1a47caaf1a4f086a16ec4
                  • Instruction Fuzzy Hash: DC117074A0A54E8FE791FFB8C858ABA7BF0FF19300F0545B7D418C70A1DA34A2408751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C24A1 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 111af48ab8871aef9e9ce60af7eefda0618af241a6564e5c5a14f6e927e7cadb
                  • Instruction ID: 0e4f3efdc6e476519f35542228708a68804862cfe833a8cb3ee86b22f83ba2cf
                  • Opcode Fuzzy Hash: 111af48ab8871aef9e9ce60af7eefda0618af241a6564e5c5a14f6e927e7cadb
                  • Instruction Fuzzy Hash: 5C11A170A0A55E9FEB92FFB488585F97BE0FF5D300F0545B7E418C70A6DA34A2848741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C48BD Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7bb2fe54bf7bed35ad9d1d85c13d292880e893c313babcc1c165aed8d9a52ccb
                  • Instruction ID: 880f7cb18749494ace49bce3d00f79ea901a845fa28e4033211dd0f38d281982
                  • Opcode Fuzzy Hash: 7bb2fe54bf7bed35ad9d1d85c13d292880e893c313babcc1c165aed8d9a52ccb
                  • Instruction Fuzzy Hash: 1A119070E0964E4FEB68EFA488A96BD7BF0FF18300F0505BFD419C21A6DE3461858701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C5BA9 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c2d4700040fc9955639ce69044b97f102eb889a59488d4e2ccdbbab4f8ae899b
                  • Instruction ID: d5f5ccac1e806e9909f4db2a30ba91c0bc473a25f530a905e26d551f03071aa9
                  • Opcode Fuzzy Hash: c2d4700040fc9955639ce69044b97f102eb889a59488d4e2ccdbbab4f8ae899b
                  • Instruction Fuzzy Hash: 48114270A0E68E4FEB51FB7888695F97BF0FF19300F0505B7D458C71A6DB24A5848741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BBD15 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9382eb890db3eba062d5fcaaaf7219ebe45ce36f89b274bc43eb18c3cae54242
                  • Instruction ID: 26a3e24513798ddd6dca440742e3763a2b81a57b741c3a6968a3fdea2ea89d0c
                  • Opcode Fuzzy Hash: 9382eb890db3eba062d5fcaaaf7219ebe45ce36f89b274bc43eb18c3cae54242
                  • Instruction Fuzzy Hash: 75117C30A0A65E8FDB55EFB8C8696FD7BE0FF18300F0504BED419C61A2DA39A640CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B11AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8ad0af8e15adca0b61c4c4a28b40f27c43f95c2de3b36c6b3948746d7308922e
                  • Instruction ID: 5a772cec422dcce6004fb656a3eabcb8fa0a7713aeefcf87d325e92da9da2c6d
                  • Opcode Fuzzy Hash: 8ad0af8e15adca0b61c4c4a28b40f27c43f95c2de3b36c6b3948746d7308922e
                  • Instruction Fuzzy Hash: E911B231E1E65E4EEB65EBB4C4A96B97BE0EF5A300F0114BED01ACA1E1DE255644CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C4A7D Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 55a244910f8d1a3418eaba9048d752fa1619476e9d7b5d393a57dcf8625b6647
                  • Instruction ID: 838427a4c590355bd48d4d906bdd15a120bfb8f6bd8217cf42d9dbf15e5c1107
                  • Opcode Fuzzy Hash: 55a244910f8d1a3418eaba9048d752fa1619476e9d7b5d393a57dcf8625b6647
                  • Instruction Fuzzy Hash: 6211B270A0954E8FEB59EB6488696B977A0FF18304F0905BFD41DC61A2DE25A690C701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BC5C0 Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7fe2856e0f72846969de2db70c8e1d2ec7529b82a3b2ee819b5d7813b8368be1
                  • Instruction ID: 34cbb74bdc296eae1bd23fed3e523e1f3f767ba7717024d065143e104a2b8675
                  • Opcode Fuzzy Hash: 7fe2856e0f72846969de2db70c8e1d2ec7529b82a3b2ee819b5d7813b8368be1
                  • Instruction Fuzzy Hash: 15116D30A0A69E8EEB56EB74C8685BD7FA0FF1A304F0104BFD419C60A2DE749644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B34B5 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a1215e79a1ab886580950d515f96fefe4b65722b4825dccb7aecbb6991f5a7dd
                  • Instruction ID: 688d79447ab3bfb110d36202fdaf2b82a62ed531f8aef95c7d104225063db645
                  • Opcode Fuzzy Hash: a1215e79a1ab886580950d515f96fefe4b65722b4825dccb7aecbb6991f5a7dd
                  • Instruction Fuzzy Hash: 5B113030A0965E8FDB59EF78C8695BE7BE0FF18300F4105BFD419C61A2DA35A5448B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C6F41 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6638a9c4fa866f9b2dfaf6a88a4771a189cbca25401c4b2b1d136231935e15cf
                  • Instruction ID: 3e0b7183693c5bc1627d8f7f29476b6e6b424fe83654550b4a8ce9cf86ed9b59
                  • Opcode Fuzzy Hash: 6638a9c4fa866f9b2dfaf6a88a4771a189cbca25401c4b2b1d136231935e15cf
                  • Instruction Fuzzy Hash: 860144B0E1A55E8FE761FBB888695BD7BE0FF5D300F0545B7D418C70A6EA34A6408741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2E21 Relevance: .1, Instructions: 53COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d2a10137edd8bc468144f7a03ccf7641caf2da369b597bd2537f6e2d1bcd1ffe
                  • Instruction ID: f47acdd24d13bd526726dc6d4574fe25cc67be255f056142923e62dfce09162d
                  • Opcode Fuzzy Hash: d2a10137edd8bc468144f7a03ccf7641caf2da369b597bd2537f6e2d1bcd1ffe
                  • Instruction Fuzzy Hash: EC01B130E1A65E4FE762AFB498685A93FE0FF19300F0245B6D418C60B7EA34E540CA40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B05D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: eaeeaa1a53372be1a73206342ec809f166ca68d1a72101ebcb46d8af47d9403b
                  • Instruction ID: c92a88a1abe0f36aed024d1b52292bcfbcc79c88a33d3e7cc178b03a197e1bd9
                  • Opcode Fuzzy Hash: eaeeaa1a53372be1a73206342ec809f166ca68d1a72101ebcb46d8af47d9403b
                  • Instruction Fuzzy Hash: C8019230A5951E8FDB58EF64C0646BA77A1FF59304F11007ED40EC71A4CE35A650CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BB8CA Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8ce17e66e716ebe13dd9b65cb1f41ef116aeda0ce0f27497944f997e15e67f77
                  • Instruction ID: 35106b408c3572f8a7f43459e7f412b8dd2a8d96f3c2ed8bb9a17f12ca012a7f
                  • Opcode Fuzzy Hash: 8ce17e66e716ebe13dd9b65cb1f41ef116aeda0ce0f27497944f997e15e67f77
                  • Instruction Fuzzy Hash: 70018030A0A61E9EEB54EF78C4A92BE77E0FF1C300F01087AD41DC21A1DE31A640CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B27FD Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c2e24d6f2f74b0310fdb90bee03a4f1531a4cf4202ba72b7a9114897ec82ccd9
                  • Instruction ID: ab3a641913826f876bbe0328d3c52f79cbb7e9e0cad34f0039599838d6c0b3ff
                  • Opcode Fuzzy Hash: c2e24d6f2f74b0310fdb90bee03a4f1531a4cf4202ba72b7a9114897ec82ccd9
                  • Instruction Fuzzy Hash: 3001B130A5A65E4FE761AFB884595A93BE0FF1D300F0245B6D40CC60A6EE38E5408A80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C77DD Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4e891e1276442da574d77a5da48c9721ab3470d4178e8aa47c073b5649c8bce0
                  • Instruction ID: 06f24f421542bd249196c8277f3a54ea58359292cc5ae2aa4624a8c621bd270d
                  • Opcode Fuzzy Hash: 4e891e1276442da574d77a5da48c9721ab3470d4178e8aa47c073b5649c8bce0
                  • Instruction Fuzzy Hash: C1019E74A4A64E8FDB9AEF68C8655B93BA0FF09304F1108BFD01EC74E2DA25A640C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8BA6D9 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ba5d361cfe303b78396573ff94bdd13df1768b386e34988a63a50acb479de516
                  • Instruction ID: 7767c53ed66d8ff0d9337a0f4e9d48477456555e61063136ae23b954a971cc17
                  • Opcode Fuzzy Hash: ba5d361cfe303b78396573ff94bdd13df1768b386e34988a63a50acb479de516
                  • Instruction Fuzzy Hash: 4401B530A5E25D9FD762AB7488695A97BF0EF0A300F0648F7D448C70B2DE38E5448741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8C0A20 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8c0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6237fd87b7bffb480c1c01643595bb5ebe051b8c8e1767bfc35fc6ee90fc26f3
                  • Instruction ID: 229d749ec4c2c15c49d1584af0c8d44798786f63c8298e01b5f6823f6ec6d70f
                  • Opcode Fuzzy Hash: 6237fd87b7bffb480c1c01643595bb5ebe051b8c8e1767bfc35fc6ee90fc26f3
                  • Instruction Fuzzy Hash: 24011A70A1590E8EEB98EFA4C4696BA77E0FF18305F11047AD41ED21A5DE35A650CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2E99 Relevance: .0, Instructions: 43COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 616d74ad3204be0ae52a8b7055013d277c8b5bffc4b7385f2ddf16031d04f9b0
                  • Instruction ID: dc7942d1129202014359bee70f83d31fe642cf05d733815d92304c957c174afa
                  • Opcode Fuzzy Hash: 616d74ad3204be0ae52a8b7055013d277c8b5bffc4b7385f2ddf16031d04f9b0
                  • Instruction Fuzzy Hash: 4F01D430A1E64E4FE752EFB484585A97FE0EF0A300F0248B2D008C70B7DA38A5448B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1BDD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2776f24e54c38a7ac649c1579c84e1db0c9a4f9e1360d33cafa6115f8073aba8
                  • Instruction ID: 03840ba7564479f9332d4b47633060d64dc72ed3846de0c649091eeb80c33e4a
                  • Opcode Fuzzy Hash: 2776f24e54c38a7ac649c1579c84e1db0c9a4f9e1360d33cafa6115f8073aba8
                  • Instruction Fuzzy Hash: 9501F230A1E69E8FDB64EF24C4256BA3BA0FF19300F01007ED808CA1A2DB359590CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 80ede25b47f82c548c49fb64c64764e9356b840b55be2470637e687563cbbdf7
                  • Instruction ID: 7850bd92735747f346537c4a89b544435cefc8c571db142e4aa37380d4fdd2f9
                  • Opcode Fuzzy Hash: 80ede25b47f82c548c49fb64c64764e9356b840b55be2470637e687563cbbdf7
                  • Instruction Fuzzy Hash: 9401A230A1550E8EDB58EFB4C4686B977A0FF08304F10087ED41EC21E4DE35A140CE44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e0330d44891b3abf1025c90dfcd36698fcb71e58a7f7c2dbc29b1cfc921d6c1c
                  • Instruction ID: 879d7ab9188aa621a113b5319476f9458c1369c1ff74d41e410a23eb0c2eba60
                  • Opcode Fuzzy Hash: e0330d44891b3abf1025c90dfcd36698fcb71e58a7f7c2dbc29b1cfc921d6c1c
                  • Instruction Fuzzy Hash: 39016D30A1551E8AEB59EFB4D4686B97AA0FF18304F51087EE41EC61E5DE35B250CE44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B05D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 85f3a87b4f4fa8d20cd6d30e4bc979b099fae365ba61eeec3ce7a23b0048aef6
                  • Instruction ID: 4796a4c434fbb9809bdc21c72f300af69214189793614455992892a2dadda923
                  • Opcode Fuzzy Hash: 85f3a87b4f4fa8d20cd6d30e4bc979b099fae365ba61eeec3ce7a23b0048aef6
                  • Instruction Fuzzy Hash: F1F0C830A6A51E8FEF64EF7494356FA7790EF09308F11007AE80DC70A1DE35A660CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B11C0 Relevance: .0, Instructions: 38COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f8982e08c2e447f3eeafea3a79cb0baabb58a51cfa972afef9b56b9aaae41b40
                  • Instruction ID: b72a0f7f51b81f99bb09e35dd0a85e9fa84d9ac59b55d515c382fcdab461dda6
                  • Opcode Fuzzy Hash: f8982e08c2e447f3eeafea3a79cb0baabb58a51cfa972afef9b56b9aaae41b40
                  • Instruction Fuzzy Hash: DCF0C831E2A56F4AEBA4EBF488692F976E0FF59304F00143ED42DC60E1EF241654CA80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B278D Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a1a7cb11d39fa8f4a423e46cfe38a06ddef2d8fe05b69b5147ef24c623af0142
                  • Instruction ID: a6af49fbbbe53b801dd1e75097bac5511b65fea8b37b557f0669cbc9bf174ee8
                  • Opcode Fuzzy Hash: a1a7cb11d39fa8f4a423e46cfe38a06ddef2d8fe05b69b5147ef24c623af0142
                  • Instruction Fuzzy Hash: D4F09630A0E79ECFDB699FB488251A93FA0FF09600F4505BED419C61E6EB389554CB86
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2719 Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5a6fe136d5cd77660bc61f8301ee7f1b8517bca4a87f9431332c9741aa226270
                  • Instruction ID: b2938d6c3802ccb27543528f73aa78cd38e612d84256d3bf54df760f3bde034f
                  • Opcode Fuzzy Hash: 5a6fe136d5cd77660bc61f8301ee7f1b8517bca4a87f9431332c9741aa226270
                  • Instruction Fuzzy Hash: C5F0963191A78E8FDB599FB498642E93B70FF0A304F4109BAE419C61E6DB38A554CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B1710 Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction ID: 0e94d10f5f9d83330b4ce44dc32aa82d3ed6b65e4dfc00f44764df6c3b581516
                  • Opcode Fuzzy Hash: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction Fuzzy Hash: D8E0E520F2A91A8AE77473AC849567571D19B4C354FBA8675F01CCE3F1DB2CDD81CA81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0FB9 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 04bc25a1a01d2de158a9b15a0be4d06ec9dd5c99f441d22157fc161b649aaba9
                  • Instruction ID: cecc507637006f0c8c049e098a78a298628f14b12c05117f480310b987e02c1e
                  • Opcode Fuzzy Hash: 04bc25a1a01d2de158a9b15a0be4d06ec9dd5c99f441d22157fc161b649aaba9
                  • Instruction Fuzzy Hash: 86E0EC20E1641D4AEBA8EB54DC60FADA6B1EF48304F5141B5D00DA3296DE346E854F84
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 00007FFD9B8BED53 Relevance: 5.1, Strings: 4, Instructions: 93COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000E.00000002.1781011018.00007FFD9B8BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8BA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_14_2_7ffd9b8ba000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$9$]$f
                  • API String ID: 0-3947874909
                  • Opcode ID: ede844ceb61007281be67a51b406415fcb6c9d6fd7db5500bb4a1450130cea30
                  • Instruction ID: 1dc2275ddca626f6d5aa4c6b619bcbb6ceb8e816fe115428bf899d51333ea485
                  • Opcode Fuzzy Hash: ede844ceb61007281be67a51b406415fcb6c9d6fd7db5500bb4a1450130cea30
                  • Instruction Fuzzy Hash: 5C41C770E0962E8FEBA8DF64D8A47A9B6B1EB18301F0145FAD40DA3691DB745EC0DF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 00007FFD9B88E6B9 Relevance: 2.6, Strings: 2, Instructions: 79COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: %$=
                  • API String ID: 0-1749545134
                  • Opcode ID: 03a15e992434f2768b90cca5e97190b784fbd14f1eb81a72bba60f69cdb8981b
                  • Instruction ID: dc798034ce3190de5bb2834edd82a99b8f344708421b96e56ce652719c13b2c9
                  • Opcode Fuzzy Hash: 03a15e992434f2768b90cca5e97190b784fbd14f1eb81a72bba60f69cdb8981b
                  • Instruction Fuzzy Hash: 2B319370A05A6D8FDBA4DF58C894BA9B7B1FB58301F1141EAD40DE72A1CB34AE808F54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88E808 Relevance: 2.5, Strings: 2, Instructions: 44COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: 1$^
                  • API String ID: 0-2815675360
                  • Opcode ID: 8249b88d454165f56544c97ff7ed50eaf4d343571a157fc4bc57267c9d70a67e
                  • Instruction ID: 6625db9550825188a740347380febd0a887f85946578ef0942ee634e8e0feabb
                  • Opcode Fuzzy Hash: 8249b88d454165f56544c97ff7ed50eaf4d343571a157fc4bc57267c9d70a67e
                  • Instruction Fuzzy Hash: 1C11E970D49A2E8BEB78EF44C8547E9B7B1EB58306F1041AAD01DA22A1CB385AC0CF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88E2B6 Relevance: 2.5, Strings: 2, Instructions: 41COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: Z${
                  • API String ID: 0-2824158054
                  • Opcode ID: 73b0fd96eff9670fb64e8e8f5acee7a9123e5f63166bc1f7b0990b07f3a5064c
                  • Instruction ID: 3c16e302f9b038acde9028bff8404df0cea054dcb4163561e47d8d80c26f1dfa
                  • Opcode Fuzzy Hash: 73b0fd96eff9670fb64e8e8f5acee7a9123e5f63166bc1f7b0990b07f3a5064c
                  • Instruction Fuzzy Hash: 64111C70E48A6D8FEB64DF04C8A47E9B7B1BB18302F1101A9D00DA26A0DB785BC0CF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B882075 Relevance: 1.4, Strings: 1, Instructions: 146COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: H
                  • API String ID: 0-2852464175
                  • Opcode ID: e2c5cb326961bc4a82a6bf9baee16e3bb91c7d9983fc29f839096c27f3c1223f
                  • Instruction ID: 0201418b1d317939cb50349823e88e1ad6d54cde2f92b23d6bf924391f199f1c
                  • Opcode Fuzzy Hash: e2c5cb326961bc4a82a6bf9baee16e3bb91c7d9983fc29f839096c27f3c1223f
                  • Instruction Fuzzy Hash: B3412631B0EA5A0FE766DBB888655B877E0EF49310F4545BBD02CC71E7DE38A9428341
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88D5F5 Relevance: .4, Instructions: 388COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b5bc37fd52b0e9c61f75e2800e2a712a23c99971639367c6bb39ffb02957edaa
                  • Instruction ID: eb95e195658627d18c7ba65ee6cb4c78633c2e18d87d27d35ef95e21c9f53fe2
                  • Opcode Fuzzy Hash: b5bc37fd52b0e9c61f75e2800e2a712a23c99971639367c6bb39ffb02957edaa
                  • Instruction Fuzzy Hash: AFE14D71E19A5D8FEB68EB98D8A4BB8B7B1FF58300F0441BDD01DD32A6DA346941CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8816A8 Relevance: .3, Instructions: 286COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2c136de6c85f93fff1a7a36d4e838781518e830a5e966a0a0c77885a1f4b80e1
                  • Instruction ID: 70714bd839f544ab26a9d815ccd29cadce566cea9b0fe118336bed64373b7f9f
                  • Opcode Fuzzy Hash: 2c136de6c85f93fff1a7a36d4e838781518e830a5e966a0a0c77885a1f4b80e1
                  • Instruction Fuzzy Hash: 4681B031B0DE498FDB59EF5C88A15A977E2FF9D300B15056EE46DC3292DE34AD028781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88C87A Relevance: .2, Instructions: 226COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 31902d2b46dab549ba88aceb4c7d89814ae16596e87f63327037d6905c3c65bc
                  • Instruction ID: fce7b1542044871dfd1f2ad04ba7ebcab673e61dba8a09b5755958ed24b6748d
                  • Opcode Fuzzy Hash: 31902d2b46dab549ba88aceb4c7d89814ae16596e87f63327037d6905c3c65bc
                  • Instruction Fuzzy Hash: AC614A72B0E96A8BE725EBA8D8695FD77A0FF08314F0505BBC069C70E7DE3461468780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8835BE Relevance: .2, Instructions: 215COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2406da3a3f3f1c8509fad5673eec62a4597935f8d74d07a22681807cf0b4efc5
                  • Instruction ID: b43b6df6bdd5076d6cf3c865f811e9df50399df54f1e67c8b2c90a7a54664b06
                  • Opcode Fuzzy Hash: 2406da3a3f3f1c8509fad5673eec62a4597935f8d74d07a22681807cf0b4efc5
                  • Instruction Fuzzy Hash: 8271C472A18D0D8FEB98DB9CD8257ACBBE1EF99350F5041BAD01DC32DADBB418018741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B894DB0 Relevance: .2, Instructions: 195COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 08002ca39090b339295c9b4c9b0f50d4099ecd6d716da6bec867e5abd8413173
                  • Instruction ID: 594c8a3e9930fb58c6c38c4c5f0913ad335e4e3de3be1e9e01ac9de8aa4d5b5b
                  • Opcode Fuzzy Hash: 08002ca39090b339295c9b4c9b0f50d4099ecd6d716da6bec867e5abd8413173
                  • Instruction Fuzzy Hash: 4F515E70E1991D8FEFA4EBA8D895AACBBF1FF58311F45017AD00DE3295CE3569818B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B881C5D Relevance: .2, Instructions: 194COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 13ecb2550c4913d474fbe70129a2e904e8103b4422e7199277d421d7cb2b3e27
                  • Instruction ID: ad4e73130af473e6b12f962bfafbbeda4ad992fa53a24daa37770de3a9ff6391
                  • Opcode Fuzzy Hash: 13ecb2550c4913d474fbe70129a2e904e8103b4422e7199277d421d7cb2b3e27
                  • Instruction Fuzzy Hash: 4951D331B19A498FDB58EF5C88A45BA77E2FF9C300B15457ED46AC7291DE34E8028780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8831A1 Relevance: .1, Instructions: 145COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 68a604428e4698150a0a173926461d2d4835631d3a45fb06a09a7f8981704878
                  • Instruction ID: 6b20523cb9ff248f16bdb55b8037763c72ad6244738a4bf66300dbb12b0e0cb3
                  • Opcode Fuzzy Hash: 68a604428e4698150a0a173926461d2d4835631d3a45fb06a09a7f8981704878
                  • Instruction Fuzzy Hash: CE512C30E09A1D8FEB64EB94D4646ED77F1FF58301F510179E019E72A1DB38A944CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88C4FB Relevance: .1, Instructions: 137COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9109b863d2512b9f1dfb527a60d354ae332b4eebbf3f4387109a647685344388
                  • Instruction ID: 8898c36f95eaf1ce1a8744d474b6bc0f2e1b75356a47fdb30a45171eec1af80b
                  • Opcode Fuzzy Hash: 9109b863d2512b9f1dfb527a60d354ae332b4eebbf3f4387109a647685344388
                  • Instruction Fuzzy Hash: 54412362B0DA2A8BEB2A77A8BC284FC7B50FF49335B050077D12DC60D7EE68A5454690
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88B404 Relevance: .1, Instructions: 127COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cf0400cfd30f31f8610cc01b533d8286b6251cdfacb6d619a0d2e739d02c3d90
                  • Instruction ID: 50fe1672f6ea89423c3f23ff7b9448531b9c44e28aef04e7d808474b5d06cfd7
                  • Opcode Fuzzy Hash: cf0400cfd30f31f8610cc01b533d8286b6251cdfacb6d619a0d2e739d02c3d90
                  • Instruction Fuzzy Hash: 2F510570E1991E8FEBA4EF94C8957FDB6F1EF58300F1041BAD41DE22A1DA346A818B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88BE48 Relevance: .1, Instructions: 108COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4a0e0af1710b5aec71094be9ab947bf3204eb9ab86d95524f0cab4de0247f2d5
                  • Instruction ID: 589ddf715358737c64c3811fdb59e2c1d80cc1f958050f47661dac89a9a48406
                  • Opcode Fuzzy Hash: 4a0e0af1710b5aec71094be9ab947bf3204eb9ab86d95524f0cab4de0247f2d5
                  • Instruction Fuzzy Hash: AE310870E19D1D8FEBA4EB98D8A5AACB7B5FF9C300F51003AD41DD32A2DE3569418B00
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88BEC0 Relevance: .1, Instructions: 93COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0d392ebcc6877ded09c88cba85f9786f87cbd97f972eda5b561a28269bc393bd
                  • Instruction ID: e49b9ea4084b492b1152842fb9bb2470a7ecf7954afc95e567bf2002bc56eb26
                  • Opcode Fuzzy Hash: 0d392ebcc6877ded09c88cba85f9786f87cbd97f972eda5b561a28269bc393bd
                  • Instruction Fuzzy Hash: 06212D70E09D1D8FEBA4EB9898A56ACB7B5FF9D300F41013AD41DD32A2CE3569418B00
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88C91D Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 281112e8adc0f34699f119965dc72b427a4b958264d5da8c90cc2bd77b97b075
                  • Instruction ID: 8cb451fbefe7b86a7de122400a0a04f3036d81851e4671738c3d7ea2e8fff274
                  • Opcode Fuzzy Hash: 281112e8adc0f34699f119965dc72b427a4b958264d5da8c90cc2bd77b97b075
                  • Instruction Fuzzy Hash: E9210832B0892A8AE759BFBCF8196ED77E0FF44336B044577D05CC6097EA3891868790
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88DC7C Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: afd2ca279dbf6029deeb262abc77844a20e15b4bd8968649d96cd266ef3ae151
                  • Instruction ID: aad93c0094aebe0c10349fc30f3ffdabb1e44cba0a9f5b26147bb89a088ec0a7
                  • Opcode Fuzzy Hash: afd2ca279dbf6029deeb262abc77844a20e15b4bd8968649d96cd266ef3ae151
                  • Instruction Fuzzy Hash: D8311D70E1965D8FEB68DF90D8A4AADB7B2FF58300F01017ED459A72A2CB785941CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88AB58 Relevance: .1, Instructions: 85COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c40e7ace25c1dfd72d4f3e639357007952d58e3da9935763b23e58cb2be60845
                  • Instruction ID: 9083e4b3bf3476c27a0da28dd58dc7cdd940c1cbdca32b9ee563abfe8dacc733
                  • Opcode Fuzzy Hash: c40e7ace25c1dfd72d4f3e639357007952d58e3da9935763b23e58cb2be60845
                  • Instruction Fuzzy Hash: CC21A130E1A91E5FEB61EBA888585BD77E2FF48310F4249B6D42CC31F5EE34A6448640
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88338F Relevance: .1, Instructions: 81COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dd7e8c5d062abbef565dba0b738126820e82e645d39abbb7ba4057d7637fae00
                  • Instruction ID: dadd2b94d19d51659c17022234e88afa98c057bbc4eb6790950fdd2fd6aa2594
                  • Opcode Fuzzy Hash: dd7e8c5d062abbef565dba0b738126820e82e645d39abbb7ba4057d7637fae00
                  • Instruction Fuzzy Hash: 8B218E3194E78A8FD7539BB488685EA3FF0EF5B200B0944EBD459CB0A2DA38954AC751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8832D2 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c9af1ce9e8db54177d1342478d34acd840e2cc7c435e067106d12dc033b402e7
                  • Instruction ID: 5c0b08921235152daba47af712c7592a33ac186d468ba75396295117d14eacf0
                  • Opcode Fuzzy Hash: c9af1ce9e8db54177d1342478d34acd840e2cc7c435e067106d12dc033b402e7
                  • Instruction Fuzzy Hash: C821E570E09A1D8FEB64EB98D8A4AECB7F1FB58301F554169D019E72A5DE386940CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B883535 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 97e9c2ea7ba8fecb7cceb953ff2e7e058d6a0c02aac3f29d66165631db684c8f
                  • Instruction ID: 292cfd0a16ab25b4dae5cd2235b45bbb4eab971b8ba2b40e3c2c4f5579bc98b1
                  • Opcode Fuzzy Hash: 97e9c2ea7ba8fecb7cceb953ff2e7e058d6a0c02aac3f29d66165631db684c8f
                  • Instruction Fuzzy Hash: 1E216D30A0AA4E8BEBA5DBA8C4657FE37E0FF59304F01047AE42ED21E5DF38A5448701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B880A01 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2654cf7adb5be08ed17c25aeaae0f3a0b58daae1ed7fd4dd982a87be254aca0c
                  • Instruction ID: d868bec62d276fbe668d86740ed4b8b0924e5f1b10fd8655ae2d380d0899ab58
                  • Opcode Fuzzy Hash: 2654cf7adb5be08ed17c25aeaae0f3a0b58daae1ed7fd4dd982a87be254aca0c
                  • Instruction Fuzzy Hash: 4411C431E2A90E4FE7A1EBA8C8595FD77E1FF58700F4145B6D02CC70A6EE34A6418700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B881F29 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 08a7695affc18aa703bf83887aee924cc61d9a3f971d4940ae68e278c5c881b4
                  • Instruction ID: 6132b2f4e7384cd02517530193b41ab6bc4643b0c190bbc59430adbc57905da9
                  • Opcode Fuzzy Hash: 08a7695affc18aa703bf83887aee924cc61d9a3f971d4940ae68e278c5c881b4
                  • Instruction Fuzzy Hash: 4D115111A4FAC65FDB3367B948744656F945F0B224B1E46FBD0E8CA0E3DE185946C302
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88BD15 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 24dc42dc888584e2b69f1c46e1516e71856b527dfa798b89d1de1910a009ca58
                  • Instruction ID: 2d78a9c2929257f124259158855b6e391e5889beb17aa407e5b2e8c2e37cbbcb
                  • Opcode Fuzzy Hash: 24dc42dc888584e2b69f1c46e1516e71856b527dfa798b89d1de1910a009ca58
                  • Instruction Fuzzy Hash: 51118230A0AA4E9FDB55EFA4C8696FD7BF1FF58300F4105BED429C61A2DA36A650C700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8811AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d88194bc616cdbca9079243e4d85077d21e9e74176c88f13ee34a0afb57dfdd6
                  • Instruction ID: fbc704444040bd46826d70e081eba3504851b257151bea618f004f7ccbc3e59d
                  • Opcode Fuzzy Hash: d88194bc616cdbca9079243e4d85077d21e9e74176c88f13ee34a0afb57dfdd6
                  • Instruction Fuzzy Hash: B4119070A0EA4E4FEB65EBA4C4696B97BE0EF5D300F0104BED02AC61E1DE355640C700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88C5C0 Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b96060e7168ce995db88fe8b819b177c93b741aa56ee9b790776adfe39af4bd4
                  • Instruction ID: d862b4d5046f4ffd8ade9b709094894470fae0c8c2d6e48dc7081a723076d45d
                  • Opcode Fuzzy Hash: b96060e7168ce995db88fe8b819b177c93b741aa56ee9b790776adfe39af4bd4
                  • Instruction Fuzzy Hash: 1D11603090AA4E8FDB56EB64C8681B97FA0FF09304F0105BFD429D60A6DA745644CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8834B5 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 98165a700619047238c605d572495fadffe6993a37b39f78ae5e2c18a7b6a629
                  • Instruction ID: c79ce60b571b38824976c9ac1508c404020281e976805eb15de5759942d3874a
                  • Opcode Fuzzy Hash: 98165a700619047238c605d572495fadffe6993a37b39f78ae5e2c18a7b6a629
                  • Instruction Fuzzy Hash: 91113030A09A4E8FDB55EF68C4695BE7BE0FF18300F0105BED42DC61A1DA35A5408700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88C0E9 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0efcd8d0b9ee92b55754c8721089983763fcfc8425ab36aa0e6c04aae61fa8ba
                  • Instruction ID: eb733f4e0b1bccc3c540ddb8924e4bddab5289b9f453db9c703351a8b8e6053d
                  • Opcode Fuzzy Hash: 0efcd8d0b9ee92b55754c8721089983763fcfc8425ab36aa0e6c04aae61fa8ba
                  • Instruction Fuzzy Hash: 6811C234A0EA8E8FDB5ADF64C4691B93BE1FF19300F5200BED419C61A6DA35A654CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8805D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 01e48fece5ee84957332bfeffc78e228e15cbc8621887f94757d113d42cb6270
                  • Instruction ID: 92b4f6f0bdc5054c4171d1bb96d39ef3d50caf6b9e43bbc96bad2a27ae37d07e
                  • Opcode Fuzzy Hash: 01e48fece5ee84957332bfeffc78e228e15cbc8621887f94757d113d42cb6270
                  • Instruction Fuzzy Hash: BD019230A0990E8FDB58EF64C0646BA77A2FF5C304F11007ED41EC31A4CE35A650CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88B8CA Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 17cf46c15e0a5af90a5d7ee2bd1e52a31b998f913fd8641cf22e38712095c5f8
                  • Instruction ID: c29d3c52c85d34b3d2c17e2f0b5177a48ac88713f7463f6c3556c9ebb29f9541
                  • Opcode Fuzzy Hash: 17cf46c15e0a5af90a5d7ee2bd1e52a31b998f913fd8641cf22e38712095c5f8
                  • Instruction Fuzzy Hash: 4C012D30A1AA4E8BEB94EF68C8A86B976E0FF5C305F11057AD429C21A1DE36A650C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8827FD Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 65bea55350d3dbf5adb9add9ab0c88c6d675d0a6ee7fbed5ef69292ea6dbaa9e
                  • Instruction ID: b2acd3066571d9d327cb13059e759e7d4422c6fc7e511be33dde023141e827fa
                  • Opcode Fuzzy Hash: 65bea55350d3dbf5adb9add9ab0c88c6d675d0a6ee7fbed5ef69292ea6dbaa9e
                  • Instruction Fuzzy Hash: C6018430A5AA4E4FEB61EFA884595B97BE0FF1D300F4245B6D41CC61A6EE38E5548700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88A6D9 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 26989f74e62b40863b1f9d620ac85aff9b538b031cb782348dadb5f2a089537f
                  • Instruction ID: 18426fddde48350c2bcbd3b559c90146a478de4e8404090516eb179d9f99def0
                  • Opcode Fuzzy Hash: 26989f74e62b40863b1f9d620ac85aff9b538b031cb782348dadb5f2a089537f
                  • Instruction Fuzzy Hash: 15017531A5EA8E9FE752EB7488695A97BF0EF09300F0649B7D458C70F6DA38A5448701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B882E99 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a1a89289a62017a1633e1396cae9e16c05f0618d3da0400749aa38bea0996dca
                  • Instruction ID: 5f98f6cf94e6ce76013decc686a32ebddfd61e02da48c3431d5f4d3a46987181
                  • Opcode Fuzzy Hash: a1a89289a62017a1633e1396cae9e16c05f0618d3da0400749aa38bea0996dca
                  • Instruction Fuzzy Hash: 3B018430A1EA4D4FD752EBB4C8595A97BE0EF4A304F4645F7D01CCB0B7DA38A6448711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B881BDD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: be0f0268308e7654f1614f0ecc7c6670bc06b84455de58a95f24ed0037458edc
                  • Instruction ID: 325478c716fab57f858dd6e4720c77d852f256aee637f1945ff9c9826f293d78
                  • Opcode Fuzzy Hash: be0f0268308e7654f1614f0ecc7c6670bc06b84455de58a95f24ed0037458edc
                  • Instruction Fuzzy Hash: F801A230A0EA8E8FDB69EF64C4655B97BA1FF59300F41017ED818C61A2DF759590C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B880610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c357efce91f72f46438883bae36ada9c849a56f50fea5c50cb9383b14a10339d
                  • Instruction ID: ecadae0aef38ffd91400cb378b6d9a91672780938de3f329e2c2489b1d3f9063
                  • Opcode Fuzzy Hash: c357efce91f72f46438883bae36ada9c849a56f50fea5c50cb9383b14a10339d
                  • Instruction Fuzzy Hash: 5E016230A1590E8FDB58FFA4C4686B973E0FF18305F51087ED42EC21E5DE35A550CA10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B880608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e53a890a4e240fbe747798a459adee350e6672f72f1ba4ce514d0a77ea5fc164
                  • Instruction ID: f5b4a95234c2c029e8c941e70ef35c7f054ce9592f5d95a2134fdc95b05a46b8
                  • Opcode Fuzzy Hash: e53a890a4e240fbe747798a459adee350e6672f72f1ba4ce514d0a77ea5fc164
                  • Instruction Fuzzy Hash: C8016D30A1590E8BEB58FFA4C4686B972A0FF18304F51087EE42EC61E5DE35A250CA00
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8805D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 96c0be1c2a89be4ffe61affdd7d2c7a01f9ae525b3931eed992c1c64cd185502
                  • Instruction ID: 7484ad94c8f0d749e4117b6802c19dadd1f67cd60ffb95c8647d0e6d62012e28
                  • Opcode Fuzzy Hash: 96c0be1c2a89be4ffe61affdd7d2c7a01f9ae525b3931eed992c1c64cd185502
                  • Instruction Fuzzy Hash: 8DF0C830A0A90E8FEB65EF6494255FA7791EF0D308F01007AE81DC30A1DE35A650C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8811C0 Relevance: .0, Instructions: 38COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bd7170ed7f6a326830c22687de00017af2b7fd9629b63a7f0a618f791e125374
                  • Instruction ID: 5fed5eb180e01a659c3e7a84413ed2155012d2a1b8df01e237cdf92925d6b94c
                  • Opcode Fuzzy Hash: bd7170ed7f6a326830c22687de00017af2b7fd9629b63a7f0a618f791e125374
                  • Instruction Fuzzy Hash: F4F0AF70E1AA5F4BEBA5EBE488692F976E0BF5D204F41143AE42EC61E1EF3816548640
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88278D Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 57c5dd6ae6379d8139a6cdc0cf92b67a8dfe628ee6d9ae7c0032600979a1957b
                  • Instruction ID: 83feeca797a1b2745602da7609b2fca59c3c92b07a2dd1d9c6d2c200ae38149b
                  • Opcode Fuzzy Hash: 57c5dd6ae6379d8139a6cdc0cf92b67a8dfe628ee6d9ae7c0032600979a1957b
                  • Instruction Fuzzy Hash: 77F09630A0EB8ECFDB69AF6488251A93BA0FF19600F4505BED419C61E6EB399550C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B882719 Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0e698ba84d9f89a6b09a755ca6404a96d2c23229c525f5948e93aad2eb54fa6e
                  • Instruction ID: 9932551c902d2312b869ce2bd3fbbcac84c48ac22a9e7db1bcfa25fa2504a71e
                  • Opcode Fuzzy Hash: 0e698ba84d9f89a6b09a755ca6404a96d2c23229c525f5948e93aad2eb54fa6e
                  • Instruction Fuzzy Hash: DEF0963050E78D8FDB59AF6488642E93B70FF06304F4505FEE429C61E2DB399555C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B881710 Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction ID: bfdc9101c552ad51212c005786044672edd403d75b1d6ee8920ebd73b87cf366
                  • Opcode Fuzzy Hash: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction Fuzzy Hash: C1E0C920F0AD0A4BEB74B3988495674B2D19B4C314FBA8675F03CC61F1EF38AE82C601
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88840E Relevance: .0, Instructions: 16COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2a2768492fc60879ecf6ac1dbfc35af86e83072b8fd1f4d1b57107b7c09ed652
                  • Instruction ID: fb6d1564950b2a4d4b21f03b9b79434114641b729be7505efcb235d588d54b4a
                  • Opcode Fuzzy Hash: 2a2768492fc60879ecf6ac1dbfc35af86e83072b8fd1f4d1b57107b7c09ed652
                  • Instruction Fuzzy Hash: C1E0B670A0981E8FDBB4DB5888647ADB3A0EB58301F5114B9811DD72A0DE305A818F50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B880FB9 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 95ec02922e819fb235a5f08f5024f14dd20502baddfe14845366cd83875f128c
                  • Instruction ID: 632da83208026f5cd759e2bfce77abdb707042f22e6c0967a1b1e6cb24bc8e78
                  • Opcode Fuzzy Hash: 95ec02922e819fb235a5f08f5024f14dd20502baddfe14845366cd83875f128c
                  • Instruction Fuzzy Hash: 7BE0EC20E1681D4BEB98EB54DC61FADA6B1EF48304F5041B5D01DA3296DE346E858F44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 00007FFD9B88E208 Relevance: 7.7, Strings: 6, Instructions: 238COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$9$S$[$`$e
                  • API String ID: 0-1713107869
                  • Opcode ID: 84e589c69e35b1a1858c48d48ef128af98fe7b4cec07c0bcdc0195a6eedf98f5
                  • Instruction ID: 94b5c762ba62b42dec109ebccafb98c1d795369275a9c5febe2fe3e35e8afd1c
                  • Opcode Fuzzy Hash: 84e589c69e35b1a1858c48d48ef128af98fe7b4cec07c0bcdc0195a6eedf98f5
                  • Instruction Fuzzy Hash: 12B1B270E09A2D8FEBA8DF54C8A47A9B6B1BF58305F1141EAD41DA36A1CB745E80CF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B88F025 Relevance: 5.1, Strings: 4, Instructions: 51COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 0000000F.00000002.1783372511.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_15_2_7ffd9b880000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: L$P$_$u
                  • API String ID: 0-601783657
                  • Opcode ID: 445c6ed3a3e47a46efbfda455c94fd84224b8f03e83c6db17cd55afd08f44aa9
                  • Instruction ID: 6bdf92999dc173914856d987c91e605667a6e16781a30ff63321e485631c7a03
                  • Opcode Fuzzy Hash: 445c6ed3a3e47a46efbfda455c94fd84224b8f03e83c6db17cd55afd08f44aa9
                  • Instruction Fuzzy Hash: 5F21B974E4962A8BEB68DF44D8A47B9B7B1BF18301F0141BED01EA66A0CB345A84CF14
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 00007FFD9B87E808 Relevance: 2.5, Strings: 2, Instructions: 44COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: 1$^
                  • API String ID: 0-2815675360
                  • Opcode ID: 8249b88d454165f56544c97ff7ed50eaf4d343571a157fc4bc57267c9d70a67e
                  • Instruction ID: f84979317f506809845834a8712d73a795e43ad4c821a02313eb4c2ec68f2bd2
                  • Opcode Fuzzy Hash: 8249b88d454165f56544c97ff7ed50eaf4d343571a157fc4bc57267c9d70a67e
                  • Instruction Fuzzy Hash: 0111B970D0962E8AEB78DF44C8947E9B7B5EB5830AF1541AAD00DA72A1DB385AC0DF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87E2B6 Relevance: 2.5, Strings: 2, Instructions: 41COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: Z${
                  • API String ID: 0-2824158054
                  • Opcode ID: 73b0fd96eff9670fb64e8e8f5acee7a9123e5f63166bc1f7b0990b07f3a5064c
                  • Instruction ID: 8b7653b5f26dfcf7a4fe06dc3c7d7078e477ee535639d8c90a947cf1ba78ae0c
                  • Opcode Fuzzy Hash: 73b0fd96eff9670fb64e8e8f5acee7a9123e5f63166bc1f7b0990b07f3a5064c
                  • Instruction Fuzzy Hash: D5110A70A4866D8EEB64DF04C8A43E9B7B1FB18306F1101A9D009A76A0DB785BC0DF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87D5F5 Relevance: .4, Instructions: 388COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c156df5ddee46829981a6d0d7e028cb0b242164d5601298ab3e87c02dc28f31f
                  • Instruction ID: d03f7b0612a5e9a5e31229cd293f70da34485ef6d0959cd08e95cb24a37e600f
                  • Opcode Fuzzy Hash: c156df5ddee46829981a6d0d7e028cb0b242164d5601298ab3e87c02dc28f31f
                  • Instruction Fuzzy Hash: CAE15B71E1965D8FEBACDB98C8A4BA8B7B1FF58304F0401B9D01DD32A6DA346981DB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8716A8 Relevance: .3, Instructions: 286COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: dc6d2d872696c78e1a2c1b5391e2d88c2a83a9ec7cab09596e29cfc95551a111
                  • Instruction ID: 16c0037bee10812bc2dda0bdf3ae0cff9ab10878be64529413d0dafcc770b488
                  • Opcode Fuzzy Hash: dc6d2d872696c78e1a2c1b5391e2d88c2a83a9ec7cab09596e29cfc95551a111
                  • Instruction Fuzzy Hash: 6C81C131B0DA494FDB58EF5C88A55A977E2FFD9304B1501BEE45DC32A2DE34A902C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8735BE Relevance: .2, Instructions: 215COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 863176b9b90938458450dc6de6b3d22033ee9e76eef73cd685660a88eff3bbd0
                  • Instruction ID: db8b9a4849095961c919d0804689dcf058b02a218a46a6a975c1fbce8d56de9a
                  • Opcode Fuzzy Hash: 863176b9b90938458450dc6de6b3d22033ee9e76eef73cd685660a88eff3bbd0
                  • Instruction Fuzzy Hash: 4971D672A18A0D8FEB98DB9CD8657AC7BE1FF99350F5001BAD00DC72DADBB418068741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B884DB0 Relevance: .2, Instructions: 195COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d53d99aa08b601315e12332d058f581aa2d151fe9bffff88a126fb227f6e673d
                  • Instruction ID: 3e5e94ad4b16a217d1edc3e07fbc279393b9b61476b0caa440d5a09c1b746df2
                  • Opcode Fuzzy Hash: d53d99aa08b601315e12332d058f581aa2d151fe9bffff88a126fb227f6e673d
                  • Instruction Fuzzy Hash: C7515C71E1991D8FEBA4EBA8D899AACB7F1FF58310F41007AD01DE3291CA3469818B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87C87A Relevance: .2, Instructions: 195COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0cd0267b6efd49cf5028fdea97fb91ea41fea7d933e5232f788ed086e28c7059
                  • Instruction ID: ca143ad20ebbd0ea070478a96f5f347b1ad80d3417f107ed9f841f1ff1b00039
                  • Opcode Fuzzy Hash: 0cd0267b6efd49cf5028fdea97fb91ea41fea7d933e5232f788ed086e28c7059
                  • Instruction Fuzzy Hash: EF513832B0991E8AE765EBA8E86C6FD77E0FF49319F05057BC01DC70A6DE3462869740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B871C5D Relevance: .2, Instructions: 194COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0297ec85c4eb0b6ddd904105986d0ee88b6885edbae994d25b2cc6e615f86ac2
                  • Instruction ID: 285f83918cb3f4f2c570bc7535ef98e414dd473613a7a8578f510a126a636440
                  • Opcode Fuzzy Hash: 0297ec85c4eb0b6ddd904105986d0ee88b6885edbae994d25b2cc6e615f86ac2
                  • Instruction Fuzzy Hash: F451E031B09B498FDB58EF5C88A45BA77E2FFD8304B15417EE45AC7291DE34E8028781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B872075 Relevance: .1, Instructions: 146COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cb43ec653fb5d23aba60ba86aeab46ac18bafe1cf36db16f1ae78929f074036b
                  • Instruction ID: daeab2b1268d166a8276bc58b75deb2f1c4aeeb8dd4eac314417883c6a9b6ce9
                  • Opcode Fuzzy Hash: cb43ec653fb5d23aba60ba86aeab46ac18bafe1cf36db16f1ae78929f074036b
                  • Instruction Fuzzy Hash: DB413331B1F64A4FE765DBB888A65B877E0FF8A314F0544BAD00CC71A2DE28A9418351
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8731A1 Relevance: .1, Instructions: 145COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bfcf7c780fe0ffc0ee0e48771f7b7610edeb16bf4a26b3f31d47a0fa73a0daf4
                  • Instruction ID: e186f8dfed638b50528ef437950c9d846f742308eebc565dfe76a5f62ac5a4f8
                  • Opcode Fuzzy Hash: bfcf7c780fe0ffc0ee0e48771f7b7610edeb16bf4a26b3f31d47a0fa73a0daf4
                  • Instruction Fuzzy Hash: 0F514C30E1A60D8FEB64EBA8D4A46ECB7F1FF49305F450179D009E72A1DE38AA45DB11
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87C4FB Relevance: .1, Instructions: 137COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8187af73fb3535c045e12e80bd12c5cd863af9171fe7f3d5bfaec75fc6c2632e
                  • Instruction ID: da383a75add994506be2552963fd1d22eac4fea16b67581ecc6d67330118b470
                  • Opcode Fuzzy Hash: 8187af73fb3535c045e12e80bd12c5cd863af9171fe7f3d5bfaec75fc6c2632e
                  • Instruction Fuzzy Hash: 36414862B0D66B8AE72A77ACBCA84FC3B50FF99339B050077D10DCB0D3ED58658556A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87B404 Relevance: .1, Instructions: 127COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1f1b3f1ee8531dca44eaa60f917ecddee15d8d9a1a9a081a70c18aacfb22ee67
                  • Instruction ID: 1a7288c85ba9e6e30039bedc84b769504c6aaaeebdc8d640bb3fe0edaf59d729
                  • Opcode Fuzzy Hash: 1f1b3f1ee8531dca44eaa60f917ecddee15d8d9a1a9a081a70c18aacfb22ee67
                  • Instruction Fuzzy Hash: DB51F770E1951E8EEBA4EF94C8A57FDB6B1FF58304F1045BAD40DE32A1DA346AC19B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87BE48 Relevance: .1, Instructions: 106COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 51a88b63011eed830605a81470f3ff114be6f95c8c8abe7d639bdd89269ceff8
                  • Instruction ID: 607f63ecc466f357a97a35d1d2af61beb4610762b180207f86ef8a6cd11b2ef0
                  • Opcode Fuzzy Hash: 51a88b63011eed830605a81470f3ff114be6f95c8c8abe7d639bdd89269ceff8
                  • Instruction Fuzzy Hash: 8131E671E1991D9FEBA4EB9898E5AECB7B6FF5C304F510039D00DE32A2DE3469419B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87DA31 Relevance: .1, Instructions: 94COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ccfe516d7ca5d7ee87c947ece6c787e3eb4dbfb50ae60c4db6d3ad3ff4bd6809
                  • Instruction ID: 3aefa5b301cae9ce049d41f020ff8fd786ba393e7f3e3bcb622eaac0aea7a10e
                  • Opcode Fuzzy Hash: ccfe516d7ca5d7ee87c947ece6c787e3eb4dbfb50ae60c4db6d3ad3ff4bd6809
                  • Instruction Fuzzy Hash: 94317E70A0D65E8FDFA5DF54C8A0AE87BB1FF99304F0101BAD40ED72A2CA745945D740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87BEC0 Relevance: .1, Instructions: 91COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b7eef019acb264f040e4e9912e52d1807ceddd1b76445c12eff876fafad45eeb
                  • Instruction ID: 7632d6766be90921746ad97e01238f18d822dabc73c64948b5cbc0b53c85bebb
                  • Opcode Fuzzy Hash: b7eef019acb264f040e4e9912e52d1807ceddd1b76445c12eff876fafad45eeb
                  • Instruction Fuzzy Hash: 8C212D70E1991D8FEBA4EBA888E56ECB7B5FF5D304F510139D00DE32A2DE3469419B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87C91D Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 373a26423be394cc4f6cbabef490a416b7dd65a402beda035f1495424c1e9ae4
                  • Instruction ID: 9db6f77cede780463255ee1cc2a2e54dc264657417d3d57932b5e8a8ef3a8f92
                  • Opcode Fuzzy Hash: 373a26423be394cc4f6cbabef490a416b7dd65a402beda035f1495424c1e9ae4
                  • Instruction Fuzzy Hash: 0C212932B0891A8AE355BFBCF4196E977E0FF84325F000577C45CC6097EA38518A8390
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87DC7C Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d30d8a6d3d4174c4f50980e4c8305a5456271107185dec6d71696eedb509eb80
                  • Instruction ID: 42cc3dcd274975d6e6fd0785afd7cd15692468de14fae79d5b80a75dd4c4d2f7
                  • Opcode Fuzzy Hash: d30d8a6d3d4174c4f50980e4c8305a5456271107185dec6d71696eedb509eb80
                  • Instruction Fuzzy Hash: C6312A70E1965E8FEB68DF90C8A4BADB7B1FF58304F0101BED449A72A2CB785941DB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87AB58 Relevance: .1, Instructions: 85COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4a8102d735a6b0c0d7bea8a2ded5722b98126e89e6139f01b92ab15656908bf8
                  • Instruction ID: fd715b7fb9373c5264df4ece95ea17b8646c9227bc4a6074e4d2ac619e2f1bef
                  • Opcode Fuzzy Hash: 4a8102d735a6b0c0d7bea8a2ded5722b98126e89e6139f01b92ab15656908bf8
                  • Instruction Fuzzy Hash: A521B230E1990E6EEB60EBA8C8985BD77E1FF5D304F024976D41CC30B5EE34A6449640
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87338F Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 487a99615dbfeb051531886c0e352525db5a8b3a00fdf4cf791d07e906f15fce
                  • Instruction ID: 5dfbd7cc90554436264e05d782b2cc224ee490a135cc3c7fafabd3cd26d8cec8
                  • Opcode Fuzzy Hash: 487a99615dbfeb051531886c0e352525db5a8b3a00fdf4cf791d07e906f15fce
                  • Instruction Fuzzy Hash: B921A13194E7CA4FD7539BB488684E93FF0EF5B204B0904E7D449CB0A2DA289646C752
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8732D2 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c679b0be3caab7b90725fc5b8c433b917fe3292e8d7d4a5acf70ca4f550bc9f9
                  • Instruction ID: 5451e4bcda2da575f608a746e99fc28fc1ffa4fd85b9d7e20c2fa2dae3fdafee
                  • Opcode Fuzzy Hash: c679b0be3caab7b90725fc5b8c433b917fe3292e8d7d4a5acf70ca4f550bc9f9
                  • Instruction Fuzzy Hash: 6A211470E0961D8FEBA4EF98C4A4AECB7F1FB58305F15413AD009E72A5CE386A41DB10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B873535 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0c14f13ec2049dcff4a68b8600186c93dab97d5eca315e00a08233f544f5ec41
                  • Instruction ID: 83cddcdb8aca3901479ea4b5c9c00b52b58c5bd33969d35f6205851801cfde10
                  • Opcode Fuzzy Hash: 0c14f13ec2049dcff4a68b8600186c93dab97d5eca315e00a08233f544f5ec41
                  • Instruction Fuzzy Hash: 7D219030A0A64E8BEBA99B64C4A57F937E0FF19308F010479D019D31E1DF29A6059702
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B870A01 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 860ab4c5605022637988f5c91b88439778132c2f501694f23328f7ea01306c4c
                  • Instruction ID: aab436a711dde0611506ad39fec5949059418c60036bbcf52ea8e9927a24e6aa
                  • Opcode Fuzzy Hash: 860ab4c5605022637988f5c91b88439778132c2f501694f23328f7ea01306c4c
                  • Instruction Fuzzy Hash: 5911BF31E2A50E8FEB90EBA8C8A95BDB7E0FF58744F4105B6D418C70A6EE34A6409700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B871F29 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d130394577d4601a34d78d97effc101bf67da36acb862f85ef872e5d2c82d9f6
                  • Instruction ID: 3c5bd7d62580f451a47158438dd56d45e67cd532844e9ed45b4ae1780e875832
                  • Opcode Fuzzy Hash: d130394577d4601a34d78d97effc101bf67da36acb862f85ef872e5d2c82d9f6
                  • Instruction Fuzzy Hash: 58118201A0F2C55EEB3367B948B54616FA49F17228B2E46FBD0D8CB4F3DA0C5945D342
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87BD15 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e23170e4151f7b3b3c13bc31d685a49267e31b89026575c0d98bd4a95117782b
                  • Instruction ID: 16b9d857df95956de7c81178c770f3e936dcaf2e31e1ccd3fec90c4e718391c7
                  • Opcode Fuzzy Hash: e23170e4151f7b3b3c13bc31d685a49267e31b89026575c0d98bd4a95117782b
                  • Instruction Fuzzy Hash: A5115A30A0A64E8FDB55EFA488A96FD7BA1FF19305F0104BAD419C31A2DA35A6508700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8711AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8192c92cc2288910248517da80fbf47c8757bafae72844dcb26e6815141a6207
                  • Instruction ID: d15fe87f969f8e54fbc84163cce4fb14937fbd57fd69e45de8294e53de16e145
                  • Opcode Fuzzy Hash: 8192c92cc2288910248517da80fbf47c8757bafae72844dcb26e6815141a6207
                  • Instruction Fuzzy Hash: 9F119330A2A64E4EEB65EBA484B96B97BE0EF19305F0104BED419C75E1DA255644D700
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87C5C0 Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2dd512ed4cbf2edbc557aee3fc41f18ecf84f0c5c71ed5dd6607dc01dab54364
                  • Instruction ID: 3835e94d0f79b5dfac40b628c511537808342943d0d592d2d2a270dc256b1d4a
                  • Opcode Fuzzy Hash: 2dd512ed4cbf2edbc557aee3fc41f18ecf84f0c5c71ed5dd6607dc01dab54364
                  • Instruction Fuzzy Hash: AE116D30A0A68E8FEB56EB64C8A85B97FB0FF09308F0104BFD419C70A2DA759644CB01
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8734B5 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4844f14bbd9f31198aec08c95ed2174aab7d9e42997e351401a6d340e3d410a9
                  • Instruction ID: 8467165d935372c442bd9f2d7ff941b8521957eb0eec9a58e2904d12b66dfecf
                  • Opcode Fuzzy Hash: 4844f14bbd9f31198aec08c95ed2174aab7d9e42997e351401a6d340e3d410a9
                  • Instruction Fuzzy Hash: 48115270A0A64E8FDB59EF64C4A95BD7BF0FF19304F1504BED419C71A1DA35A6418701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B872E21 Relevance: .1, Instructions: 53COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e8da74cc8ffd8709270beb5e460dfd98fbd70f87297fa20afceb3641d6537872
                  • Instruction ID: c7c09bf27066a9500962baa24f62d477d303819d8e7a26f2aeebd7e30c17d64f
                  • Opcode Fuzzy Hash: e8da74cc8ffd8709270beb5e460dfd98fbd70f87297fa20afceb3641d6537872
                  • Instruction Fuzzy Hash: 3601B131E1B64E4FEB61AFA488A85A93BE0FF1A304F0205B6D418C70A7EA34E6409701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87C0E9 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4517157371d908d1957744eba7e8ee5419452c7765e4662155349527594a9083
                  • Instruction ID: 3036a0e17f6dc38db78160f7cccdc36e36e58e2ac1f067a6e0d0f5e454ef245c
                  • Opcode Fuzzy Hash: 4517157371d908d1957744eba7e8ee5419452c7765e4662155349527594a9083
                  • Instruction Fuzzy Hash: 1811CE30A0A68E8FDB59DF64C4A92B93BA1FF19308F5200BED409C71A2DA35A654CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8705D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 281a6ff0da88207d3737478a5f256338641c7b6bf752c5c983ab0786b456d10e
                  • Instruction ID: 299deff1534a8c40fb03be1dfeabe30b38036e31ea3cb07ab6acd80475b5cdd8
                  • Opcode Fuzzy Hash: 281a6ff0da88207d3737478a5f256338641c7b6bf752c5c983ab0786b456d10e
                  • Instruction Fuzzy Hash: 92019230A0950E8FEB58EFA4C0A96BA77A1FF98308F11007ED40EC35A4CE35A650DB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8727FD Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 47737f3ec1bdc4ad27cb933e6b624f0fadf399acc9177ffa2199245a64be1760
                  • Instruction ID: 4c0da184a0b5988ed013605f93050122e4eea46f06332850fe55979c5bb1277b
                  • Opcode Fuzzy Hash: 47737f3ec1bdc4ad27cb933e6b624f0fadf399acc9177ffa2199245a64be1760
                  • Instruction Fuzzy Hash: 8501B130A0B60E4FE761AFA484995A93BE0FF1E304F0245B6D40CC30A6EE38E5409600
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87B8CC Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a20311460eb69759542b54d1bd530b54151585aca5b3220510b2e7a848057cad
                  • Instruction ID: 53f8024fcd7d55d27113b30cad88ba131f58718512c493da4bca496abecd2f52
                  • Opcode Fuzzy Hash: a20311460eb69759542b54d1bd530b54151585aca5b3220510b2e7a848057cad
                  • Instruction Fuzzy Hash: 32014030A0954E8EEB94EF68C4B82BA77E1FF1C305F1104BAD41DC31A1DE35A650D741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87A6D9 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d8e248c362295e2b53d010165660be711ab4dab2e498dd1d9fbb34430fca807b
                  • Instruction ID: ee9661f8f05f49573737def21367f3bc835dfc742812ed4aa25cfe617dcfe342
                  • Opcode Fuzzy Hash: d8e248c362295e2b53d010165660be711ab4dab2e498dd1d9fbb34430fca807b
                  • Instruction Fuzzy Hash: 0101B131A0E28D9FE762EB7488A95A97BF0EF0A344F0648B6D448C70B2DA38A5449301
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B872E99 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7122cd6dc6becdf027489147b6ef93d33046dfcdefb86f0d33ceca726e678b23
                  • Instruction ID: 5b9a9bbe3574b476197e8ffcea73613f6c8cc08341c57442d706d2d16e5283d0
                  • Opcode Fuzzy Hash: 7122cd6dc6becdf027489147b6ef93d33046dfcdefb86f0d33ceca726e678b23
                  • Instruction Fuzzy Hash: 7A018431A0F64D4FE752EBB488995A97BE0EF4A304F0645F7D00CC70B7DA38A6449711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B871BDD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5400262a2f53e6d95b706eb3a78b9e42350316fcba0b936eb442d67ce0e87a0f
                  • Instruction ID: 9bc0397b6b134a6892840a02a206e456f76dfe520f078dc4359a840f75fb5b8b
                  • Opcode Fuzzy Hash: 5400262a2f53e6d95b706eb3a78b9e42350316fcba0b936eb442d67ce0e87a0f
                  • Instruction Fuzzy Hash: E901A23090A68D8FDB65EF64C4A55B97BA0FF59304F4100BAD80CC34A1DA759590D740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B870610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f72d7b6ea7539a2c444244904ced25ccb5099556670093733248f46eed3d39f1
                  • Instruction ID: 34dc0742167c0f69670c0c53213728750c78783aff6f38098d5a9487ddef462b
                  • Opcode Fuzzy Hash: f72d7b6ea7539a2c444244904ced25ccb5099556670093733248f46eed3d39f1
                  • Instruction Fuzzy Hash: 1F016230A1A50E8EDB58EFB4C4A96B973A0FF19309F51087ED41EC21E5DE35A590DA10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B870608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6611b63e69b87eb772de8c77b5df5e426b4adbf26e7663ae61fa885d0c3ea234
                  • Instruction ID: 75a7fc9f1bfdcc04cd59f96681735b308bb9288f32f27878e931ed3625090df4
                  • Opcode Fuzzy Hash: 6611b63e69b87eb772de8c77b5df5e426b4adbf26e7663ae61fa885d0c3ea234
                  • Instruction Fuzzy Hash: 40018130A1650ECBEB58EFA4C5A96B973A0FF1D309F51087EE41EC71E5DE35A250DA00
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8705D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b6fdc811ae4243117ab43af7f935b769bf5c474ac0eae4cee6b9e6e66d45449b
                  • Instruction ID: 1f979303a11d52cfc750a1ef7824470143b934c994efc58a9d72629ad6c2c109
                  • Opcode Fuzzy Hash: b6fdc811ae4243117ab43af7f935b769bf5c474ac0eae4cee6b9e6e66d45449b
                  • Instruction Fuzzy Hash: 8CF0C830A0A50E8FEB64EF6494655FA7794EF4930CF01007AE80DC34A1DE35A650E740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8711C0 Relevance: .0, Instructions: 38COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fab5cc351e4769d327666ca105a90d0147a11c3839289d7f60add0359cfc3277
                  • Instruction ID: 0cd72861f15757dc049d2a2815bd42261f9b25fc0fa5fa3c5646e966cc5a12c3
                  • Opcode Fuzzy Hash: fab5cc351e4769d327666ca105a90d0147a11c3839289d7f60add0359cfc3277
                  • Instruction Fuzzy Hash: 52F02830E2A64F8AEB64EBE488B82F973E0FF19309F00003ED42DC34E0EE241654D240
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87278D Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0ac923cc4af7a3f6751f0e076db6f85439f80855be41beb3d0c399d0b64cd1f1
                  • Instruction ID: 2579dc5e5f84aa49f516d873004ca09cc394bfc4e03ee64a0b65b0cf635406c2
                  • Opcode Fuzzy Hash: 0ac923cc4af7a3f6751f0e076db6f85439f80855be41beb3d0c399d0b64cd1f1
                  • Instruction Fuzzy Hash: 14F0623090B68D8BDB699F6488651A93BA0FF1A644F4504BED419C60E6DA3895508701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B872719 Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d4c3a63303d1f76906467f08a109c480b795ab1de914ab755da2a2d9256c4746
                  • Instruction ID: 0ef1cf199c790932213cd0b19b9b368ea32e265e25d22e00730d8dd04d35e190
                  • Opcode Fuzzy Hash: d4c3a63303d1f76906467f08a109c480b795ab1de914ab755da2a2d9256c4746
                  • Instruction Fuzzy Hash: 1DF0623050F38D8FDB599F6488A56A93BB0FF06204F4605FAE419C61E2DB389554C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B871710 Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction ID: d63e0937ab7d4b5fe068779afbf385b7cc99f16c3437087bcd8f82eba8896ca3
                  • Opcode Fuzzy Hash: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction Fuzzy Hash: D4E0C020F0A50A4AE774735884D557461D1DB5831CFBA8675E01CC75F1DB289E81A641
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87840E Relevance: .0, Instructions: 16COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2a30c4d112d0fc1b76e9e12968e8667bebbea14a0de729bcda1e232e9e298c9e
                  • Instruction ID: 78c7c180fa09fc90ee7defb5935e49241f0a40543253de7f6d1c8de989db8129
                  • Opcode Fuzzy Hash: 2a30c4d112d0fc1b76e9e12968e8667bebbea14a0de729bcda1e232e9e298c9e
                  • Instruction Fuzzy Hash: 00E0B67090981E8FDBB4DB5888A47BD73A0FB58305F1104B9810DD72A4EE345A819F50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B870FB9 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 66b98be29bb750a815e93db2d27ccda7fa7808308dc4287056f5ccf46f3bc890
                  • Instruction ID: 978837246ee76a9ad77d7b2a4924706bdbc9383d0e44e667e62426c293fa84ac
                  • Opcode Fuzzy Hash: 66b98be29bb750a815e93db2d27ccda7fa7808308dc4287056f5ccf46f3bc890
                  • Instruction Fuzzy Hash: 51E0EC20E1A51D4AEB98EB58DCA4FADA6B1FF48308F5041B5D00DA3296DE346E855B44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 00007FFD9B87E208 Relevance: 7.7, Strings: 6, Instructions: 238COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$9$S$[$`$e
                  • API String ID: 0-1713107869
                  • Opcode ID: a6bbcbb71215e5df0ba907b96fa0e946b60619e72d0aa5f5695380a3a6245201
                  • Instruction ID: bef72f65a597d87faf96c06177b94a14f259eb6bcbca308e38e8a8d354dcf07e
                  • Opcode Fuzzy Hash: a6bbcbb71215e5df0ba907b96fa0e946b60619e72d0aa5f5695380a3a6245201
                  • Instruction Fuzzy Hash: 06B1B170E0966D8FEBA8DF54C8A47A9B7B1FF58305F0141EAD40DA76A1CB745A80DF40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B87F025 Relevance: 5.1, Strings: 4, Instructions: 51COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000010.00000002.1783913857.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_16_2_7ffd9b870000_Registry.jbxd
                  Similarity
                  • API ID:
                  • String ID: L$P$_$u
                  • API String ID: 0-601783657
                  • Opcode ID: 445c6ed3a3e47a46efbfda455c94fd84224b8f03e83c6db17cd55afd08f44aa9
                  • Instruction ID: 05a85df515ddcffb5b3023daa181f3de20d6d3c02aad01339167466182e093d1
                  • Opcode Fuzzy Hash: 445c6ed3a3e47a46efbfda455c94fd84224b8f03e83c6db17cd55afd08f44aa9
                  • Instruction Fuzzy Hash: 7121A874E0922A8BEB68DF54C8A47B9B7B5FB58305F0141FAD00EA7690CB341A84DF14
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 00007FFD9B8AE6B9 Relevance: 2.6, Strings: 2, Instructions: 79COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: %$=
                  • API String ID: 0-1749545134
                  • Opcode ID: 61ad1e1035c90e55d310a16b11410c7087903bf55d72385bb6cf8a4e9fca508d
                  • Instruction ID: 9bd95bfeefa4cf8858a2fdb6b9525fad80b10cbcf2601ed5ae6fd183b1463389
                  • Opcode Fuzzy Hash: 61ad1e1035c90e55d310a16b11410c7087903bf55d72385bb6cf8a4e9fca508d
                  • Instruction Fuzzy Hash: 5C31B470A0566D8FDBA4DF48C894BAAB7F1FB58301F1041EAD00DE36A0DB34AE818F14
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AE2B6 Relevance: 2.5, Strings: 2, Instructions: 41COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: Z${
                  • API String ID: 0-2824158054
                  • Opcode ID: f28d5e8a5e899d2e2e2e1cf5b0a4d0d43a38718fff6f7805789981a35f70ef63
                  • Instruction ID: 6b0310dbfb5b8de4109cb863e32a30861907c4b5eaa1fc7ab2bded31a751c434
                  • Opcode Fuzzy Hash: f28d5e8a5e899d2e2e2e1cf5b0a4d0d43a38718fff6f7805789981a35f70ef63
                  • Instruction Fuzzy Hash: 0A111F70D4866D8FEB64DF44C8A83E9B7B1BB18302F1105A9D00DA26E0DB785BC1CF50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A2075 Relevance: 1.4, Strings: 1, Instructions: 146COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: H
                  • API String ID: 0-2852464175
                  • Opcode ID: f61a41a1139b51bb5e84855e1e02614a91436bcf20fa5c767165e1ea27d64fd5
                  • Instruction ID: c46672a75cff0c489a68d0f4d4eec988f8265d4cceb987af1185e7a698a4b69c
                  • Opcode Fuzzy Hash: f61a41a1139b51bb5e84855e1e02614a91436bcf20fa5c767165e1ea27d64fd5
                  • Instruction Fuzzy Hash: 44415731B0EA4A4FE765DBB888655B97BE0EF49310F0545FBD00CC71E3DE28A9428351
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B5D30 Relevance: 1.3, Strings: 1, Instructions: 51COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: "
                  • API String ID: 0-123907689
                  • Opcode ID: 44f1746b001c48f20981ea2ebbbf108a1c98b503dcb6f43f1ab3b5d62b71e65a
                  • Instruction ID: 0f80250bf400cec397ca88858d4dd54f284f25e8e0d0d0fa22a2c24679c9a007
                  • Opcode Fuzzy Hash: 44f1746b001c48f20981ea2ebbbf108a1c98b503dcb6f43f1ab3b5d62b71e65a
                  • Instruction Fuzzy Hash: EC119670E0952D8FEB69EB94D864BECB6B1FB58301F1141BAD409A22A1CB785A84DF44
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2E88 Relevance: .5, Instructions: 514COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2050aba34c32e76b0c5194f44a5d3207241585ceaffc33bf130bcf1e1eabd67e
                  • Instruction ID: 178d27f62dd0aec4609d02a5da2f9f917135346aa03605b49afead1a11a96278
                  • Opcode Fuzzy Hash: 2050aba34c32e76b0c5194f44a5d3207241585ceaffc33bf130bcf1e1eabd67e
                  • Instruction Fuzzy Hash: 80412B12A0F6EA4EE762ABB89C765E97FE0EF17315B0900F7D098CB0E3DD1865458781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2EFA Relevance: .5, Instructions: 455COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e172e0ba759f3727c52d35c599ed59cc93313fba4921086d25937adcafbc5458
                  • Instruction ID: 998d657fe382b80c10b8ce7116443d07b4efe2cee528b2d24a963458097257c6
                  • Opcode Fuzzy Hash: e172e0ba759f3727c52d35c599ed59cc93313fba4921086d25937adcafbc5458
                  • Instruction Fuzzy Hash: 9611936190F7DA4EEB669BB48C651697FB0EF17201F0900FBD498C70E3E9186A548782
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AD5F5 Relevance: .4, Instructions: 388COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ba0a61418e7a2dc82743204792ff45f1f6cbe67efe72d26852abd8d4ffa2626e
                  • Instruction ID: 0bb559878a98d2e76e2856da616485232f1259cc4a8a37aa160a4f71a49adcec
                  • Opcode Fuzzy Hash: ba0a61418e7a2dc82743204792ff45f1f6cbe67efe72d26852abd8d4ffa2626e
                  • Instruction Fuzzy Hash: 8AE14B71E1965D8FEBACDB98D8A4BB8B7B1FF58300F0441B9D01DD32A2DA346941CB51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B3755 Relevance: .3, Instructions: 303COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e587cfe5918c3991e987b7477ff708a6391b90b00602795dbf7f83ed789aa05
                  • Instruction ID: 57d59d24f4902925073af8b90f6b9030aa3fafb2a0d9d7f6d90c2b82de513212
                  • Opcode Fuzzy Hash: 8e587cfe5918c3991e987b7477ff708a6391b90b00602795dbf7f83ed789aa05
                  • Instruction Fuzzy Hash: A4C19870E1962D8EDBA4EBA8D8657EDB7B1FB5C300F5141BAD00DE3291DE746A848F40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A16A8 Relevance: .3, Instructions: 286COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 9d8737454138b86e00c460eb79fd98bcbb685d8389d8bd5ccac50fe2552bf3cd
                  • Instruction ID: 49954c152101f72349935401da9ff107fa398bbdc76bfcfb047dda085b694873
                  • Opcode Fuzzy Hash: 9d8737454138b86e00c460eb79fd98bcbb685d8389d8bd5ccac50fe2552bf3cd
                  • Instruction Fuzzy Hash: 2981D131B0DA494FDB58EF5C88615A977E2FF9A300B15467EE45DC3292DE34AD02C781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A35BE Relevance: .2, Instructions: 215COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c51c6464fb287776ca6719f4f6d7c36da7a849c4ac7061fa147dce51f32329b6
                  • Instruction ID: 163909ede6520b811e7fdb1b8f1e9c7daf7aee226015c7db4e47a94a5968e0d1
                  • Opcode Fuzzy Hash: c51c6464fb287776ca6719f4f6d7c36da7a849c4ac7061fa147dce51f32329b6
                  • Instruction Fuzzy Hash: 4D718671A1894D8FEB98DB9CD8657ACBBE1EF99350F9041BAD00DD32D6DBB41801C742
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1C5D Relevance: .2, Instructions: 194COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 37dd5aa0821e50f994ab4af71b36a9fb8fd4ca073c38065601f4753262ee8bd0
                  • Instruction ID: 0d7e19430b4374da6447b3a1e260c7e9480f48e1bb30c24e0bc5a61b9e4c15a8
                  • Opcode Fuzzy Hash: 37dd5aa0821e50f994ab4af71b36a9fb8fd4ca073c38065601f4753262ee8bd0
                  • Instruction Fuzzy Hash: 2B51E131B09B4D8FDB58DF5888A45BA77E2FF99300B15467ED45AC7292DE34E802C780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4D9D Relevance: .2, Instructions: 193COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 036017e9e7db7c3ec3e5c21983aee01826879ff70ca1c61bd3d2c80626e08594
                  • Instruction ID: d5e0d011a6a8b72875941d6c4133fda9af15512614faaeb1d8432c631b49fcff
                  • Opcode Fuzzy Hash: 036017e9e7db7c3ec3e5c21983aee01826879ff70ca1c61bd3d2c80626e08594
                  • Instruction Fuzzy Hash: FD514170E1991D8FEBA4EBA8D8A5BACB7F1FF58310F45016ED00DD3292DE3469418B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B35FA Relevance: .2, Instructions: 179COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 82854f0b7640e01c6e506fb8e5464148ca4c5d7bc313e3712fff590407992f2a
                  • Instruction ID: dcf00ce513c9cf7096e86ecfaee0b50d0259e6ae2dd8f2f351bc396236828b87
                  • Opcode Fuzzy Hash: 82854f0b7640e01c6e506fb8e5464148ca4c5d7bc313e3712fff590407992f2a
                  • Instruction Fuzzy Hash: B1416B237099695EE321B7FCFC6A4FA7BA0EF823B7B04047BD148C6062D920944987D1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4DB0 Relevance: .2, Instructions: 168COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6a3fcd9e68f16cd49d9f918eefa6c708161254261ec7ecf064801cb124901c52
                  • Instruction ID: ff93a2770a1757ac5dc4dbafc0b65fd93978d2c80e94d858ac704f8cc2ae3795
                  • Opcode Fuzzy Hash: 6a3fcd9e68f16cd49d9f918eefa6c708161254261ec7ecf064801cb124901c52
                  • Instruction Fuzzy Hash: 5D513270E1991D8FEFA4EBA8D895BACB7F1FF58310F44016AD00DD3295DE3469458B40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A17C0 Relevance: .2, Instructions: 163COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 29a1222cd7ac312201b265a9b7e43a21772fe480983ab57bae38d26df6d8327d
                  • Instruction ID: 4ceb40c00b7c8f23d4c3d8a84f7173c0501531eddd654effe723bf03f330f581
                  • Opcode Fuzzy Hash: 29a1222cd7ac312201b265a9b7e43a21772fe480983ab57bae38d26df6d8327d
                  • Instruction Fuzzy Hash: 86418D30B18A4D8BDB5CEF4888656BA73E2FB99305B14467EE45ED3295DE30E912C780
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A31A1 Relevance: .1, Instructions: 145COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4ed95cc6b3447392d30d33f7156985e23db9fae418edf65b0cbb1ca675b7ae1b
                  • Instruction ID: 3bcbbde241a0d1b4b06869bbde1b15e1c984afd266fac8f462764a8ca02fcac1
                  • Opcode Fuzzy Hash: 4ed95cc6b3447392d30d33f7156985e23db9fae418edf65b0cbb1ca675b7ae1b
                  • Instruction Fuzzy Hash: 75512B70E0A61D8FEB64EB94D4646EDB7F1FF59301F41017AD009E72A5DA38AA44CB10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC4FB Relevance: .1, Instructions: 140COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 74234170d9281f4e1b58ccd678a79e167b0ea9cd65a9ff273d4c73de1f1426f4
                  • Instruction ID: 418e36ea092d2310782461fe64e3fa4bb9bd2b54d7ef076168bbf62cfa8ff7eb
                  • Opcode Fuzzy Hash: 74234170d9281f4e1b58ccd678a79e167b0ea9cd65a9ff273d4c73de1f1426f4
                  • Instruction Fuzzy Hash: 43412262B0D62A8AE72A7BECBC294FC3794FF49335F050077E109C60D3ED68A14586A1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AB404 Relevance: .1, Instructions: 128COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4a63fdcf02b4c0e9261e54bb96c60e648809794d4febead310ea2b4bc6b77cfb
                  • Instruction ID: 1fafec8374c23c36ad158f7670028c5123db63689c14089790e3bd2567cdaff8
                  • Opcode Fuzzy Hash: 4a63fdcf02b4c0e9261e54bb96c60e648809794d4febead310ea2b4bc6b77cfb
                  • Instruction Fuzzy Hash: C3510870E1961E8FEBA4EF94C8557FDB6B5FF58300F1041B6D40DE22A1EA346A81CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ABE48 Relevance: .1, Instructions: 108COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f34c76cf65d6859a8cf0e62e28b02b4bd794aacffa3c293bf9cf19053c326abf
                  • Instruction ID: d6882d27a6074bf9de0cb1698e38857e9dcb6040e4328fa17129dcdca1234aac
                  • Opcode Fuzzy Hash: f34c76cf65d6859a8cf0e62e28b02b4bd794aacffa3c293bf9cf19053c326abf
                  • Instruction Fuzzy Hash: 2931E670E1991D8FEBA4EB9898A5AACB7B5FF5C300F51103AD00DD32A2DE3469418B10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ABEC0 Relevance: .1, Instructions: 93COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a3f4f43fac1e1ef4bd299a879311bf7e0f3307dc6e1f56dc93f280e0e2d91f8b
                  • Instruction ID: 7557129a1c44a327a9316a70d3c5e8fd34a19b7b4fe5f774e7e3f0a5dd25265a
                  • Opcode Fuzzy Hash: a3f4f43fac1e1ef4bd299a879311bf7e0f3307dc6e1f56dc93f280e0e2d91f8b
                  • Instruction Fuzzy Hash: 57212870E1995D8FEBA4EBA888A56BCB7F5FF5D300F55113AD00DE32A2DE3469418B10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ADC7C Relevance: .1, Instructions: 90COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3d40c8b89d259e4ebd0bd9470322f4667fc16a25233feaa61134b8ded5bae70f
                  • Instruction ID: abaf83d463f82cfbc4c0973c0f38426e731c30a8b5f5059a14cfa8279a96abae
                  • Opcode Fuzzy Hash: 3d40c8b89d259e4ebd0bd9470322f4667fc16a25233feaa61134b8ded5bae70f
                  • Instruction Fuzzy Hash: 68311A70E1965E8FEB68DB90C864BADB7B1FF58300F4101BAD449A76A2CB786941CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B7245 Relevance: .1, Instructions: 89COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1fe3eaceedbac57a4df32d190b438258f9a55474a48b8befda09171d5f932c83
                  • Instruction ID: 6ff64037274e7fce005c910e3b45d7c4615e8e759c3c4c46096f83bfb6f049fa
                  • Opcode Fuzzy Hash: 1fe3eaceedbac57a4df32d190b438258f9a55474a48b8befda09171d5f932c83
                  • Instruction Fuzzy Hash: 4121F234A0A75E8FEB65ABB0C4242FD77E0FF0D314F01057AD40AD61E2DE38A5448B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AAB58 Relevance: .1, Instructions: 85COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7ef26327bdf63cdfb3f2aed903137dc99dfd30cfd9781b5b1ad2963aeab3eba4
                  • Instruction ID: e8862e2cd49541449c31b890990806200f68f5ce3106c5ef64628e3aa0230ef4
                  • Opcode Fuzzy Hash: 7ef26327bdf63cdfb3f2aed903137dc99dfd30cfd9781b5b1ad2963aeab3eba4
                  • Instruction Fuzzy Hash: 0D21E030B0A90E5EEB60EBA8C8685FD77E2FF4C300F0249B6D01CC31B6EE34A6448610
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B6A8D Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 1a63d6c527d38e9e8f5ebff1855844a66334e8fb2215c2331c5b67e2880eb784
                  • Instruction ID: 54863bb9d5be987b22dc5cf1267eba414d36e1714b7ff15f8d357753729bfc40
                  • Opcode Fuzzy Hash: 1a63d6c527d38e9e8f5ebff1855844a66334e8fb2215c2331c5b67e2880eb784
                  • Instruction Fuzzy Hash: 5A21E170B0E64E8BEF689B7488761B97BA0FF19300F0590BAD41DC20E2DE34A5548B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B6FC1 Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: af092ed3e8b0ce5f376d9c3ec00829a6ee4ab9a2a68a733074bd26b204d7f69e
                  • Instruction ID: 2f0575072329cbfbbf8c088ed092a19fd13677c18e2591143dbde37d91d1b182
                  • Opcode Fuzzy Hash: af092ed3e8b0ce5f376d9c3ec00829a6ee4ab9a2a68a733074bd26b204d7f69e
                  • Instruction Fuzzy Hash: 65216035E0A62E8EEB61EBB488656FD77E0FF19310F010476D40CD21A5EA38A6158B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A338F Relevance: .1, Instructions: 80COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7793e321af27cad4f66c6dea69acd26800392944ae1f6708281731764977fc11
                  • Instruction ID: 3a0e89e350475c01448821cf737e0472a69ef8c25f2459f358664cd3944a5ca9
                  • Opcode Fuzzy Hash: 7793e321af27cad4f66c6dea69acd26800392944ae1f6708281731764977fc11
                  • Instruction Fuzzy Hash: A721A13194E7CA4FD743ABB488685A93FF0EF5B300B0944EBD449CB0B3DA29954AC721
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A32D2 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 407e409da3dd9e45df0563eada9b512fe8c22dbcc9f8da485e84101ed27b11ff
                  • Instruction ID: e054f8dd8d2e3b612d3758b13f209f21fbeeecefbb333af0b4de51f5cb79aeba
                  • Opcode Fuzzy Hash: 407e409da3dd9e45df0563eada9b512fe8c22dbcc9f8da485e84101ed27b11ff
                  • Instruction Fuzzy Hash: 7D21F470E0961D8FEB64EF98D4A4AECBBF2FB58301F554179D009E72A5DE386940CB20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B70D1 Relevance: .1, Instructions: 78COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b98cc979ef0f78078603346fc1df8ecba9049ec1407542d521bc2472c0e2d1e6
                  • Instruction ID: f81b3ed3965bd91be711b8b4387eb22d574ff4fc9762782d16224975da9c7c25
                  • Opcode Fuzzy Hash: b98cc979ef0f78078603346fc1df8ecba9049ec1407542d521bc2472c0e2d1e6
                  • Instruction Fuzzy Hash: 11211034E0A65E8FEFA5AF74C4696BE77E0FF18304F01047AD41DC61A1DA35A6518B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A3535 Relevance: .1, Instructions: 77COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7b601cdc886a8d7db2ac7ba0638f28ed60fea1960555eaa69a30e6177b5c7e4a
                  • Instruction ID: ca249f1410bcd2425350b58fba993dc89368f78d04a66c2d3f6a8df22bd8910b
                  • Opcode Fuzzy Hash: 7b601cdc886a8d7db2ac7ba0638f28ed60fea1960555eaa69a30e6177b5c7e4a
                  • Instruction Fuzzy Hash: A9218E30A0A64E8BEBA9DBA8C8257F937A0FF59304F01047AD01EC21E1DF78A504C721
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B7769 Relevance: .1, Instructions: 71COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6740314e8fad9ddf562c12f0190ab01db574cd4a1d03de6b7f1141658e927c27
                  • Instruction ID: ddbcb7b20b90dda34d001e3ef78753ae6f4d789620a0b483f901ebc03e93bdf3
                  • Opcode Fuzzy Hash: 6740314e8fad9ddf562c12f0190ab01db574cd4a1d03de6b7f1141658e927c27
                  • Instruction Fuzzy Hash: 92218E34A0A65E8FEB69DF74C8656BD7BA0FF19304F1104BAD41DC61E2DE38A650CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0A01 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 78ceb4deef8e9c05bf21a399b71f0b4185029fffa99769e45f13d5f6a982273c
                  • Instruction ID: 98bc989cf6e249bf15b78e9c65d4a0ecb927fee3c73137b65b21bdcf9e5c978d
                  • Opcode Fuzzy Hash: 78ceb4deef8e9c05bf21a399b71f0b4185029fffa99769e45f13d5f6a982273c
                  • Instruction Fuzzy Hash: A311B231E1A50E4FE790EBA888695BD77E1FF58700F4146B6D01DC70A6EE34B6448710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B2D99 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0c3b5671140be636405adaddabed8fa91e150b909299ae7debb557a794a43570
                  • Instruction ID: 3e3196f3c473f759b30c3b9225d150ff3bf85128a4b16b87a3dbb3ce2e196718
                  • Opcode Fuzzy Hash: 0c3b5671140be636405adaddabed8fa91e150b909299ae7debb557a794a43570
                  • Instruction Fuzzy Hash: 9C21D83090E69E4FE752EBB488695EA7FF0FF1A310F0905F6D458C70A3DA289554C791
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B71D9 Relevance: .1, Instructions: 69COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d965535cc1b404ca815b2fa62626367244c65d74f5254082f8c001268b8a00f0
                  • Instruction ID: f56e58e9dba4745dbc49ae0382eb615be2756cf162bbefc43361b62f5e89970b
                  • Opcode Fuzzy Hash: d965535cc1b404ca815b2fa62626367244c65d74f5254082f8c001268b8a00f0
                  • Instruction Fuzzy Hash: E9218134E4A65F4FEB65EF7488695FD7BE0FF09300F0104B6D41DC60A6DA38A6448B51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1F29 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 864a2ad63e93e0c3ff2a7e09c60ae489f61e8702c46c74a781f4805094f2d2d0
                  • Instruction ID: 06aa505cddc1106ddf1bfaa219f9abc3b05deb0d85ecb2931e88b91720b6a01c
                  • Opcode Fuzzy Hash: 864a2ad63e93e0c3ff2a7e09c60ae489f61e8702c46c74a781f4805094f2d2d0
                  • Instruction Fuzzy Hash: C3117C11A4F6C65EEB3367B948744656FA45F07224B2E46FFD0D8CB0E3DA0C598AC322
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B42F5 Relevance: .1, Instructions: 67COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c66fcc2cd6441a38201525ec487e2a93c844cce3d8259df64a480b96be3abf24
                  • Instruction ID: 1bc852280a2ed03aa021ecec3438a139a49f0f193c6251f4c5ceb19da0da7a0a
                  • Opcode Fuzzy Hash: c66fcc2cd6441a38201525ec487e2a93c844cce3d8259df64a480b96be3abf24
                  • Instruction Fuzzy Hash: 2711A531E0965E8FEB98DFA8C4666B97BA0FF5C300F0905BED41DC31A2DA34A540CB80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B68B1 Relevance: .1, Instructions: 66COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: df00da88a7d07138c0af83b68e13bb8f378e50b311c07e79309ad558b819ca03
                  • Instruction ID: 6a262f2bd1e71189caa35df2530bf0a31171b4b52ac352da2833781d3df03f64
                  • Opcode Fuzzy Hash: df00da88a7d07138c0af83b68e13bb8f378e50b311c07e79309ad558b819ca03
                  • Instruction Fuzzy Hash: 1911B470A0964E8FEB58DF6884692BD7BE0FF28300F0105BED41DC31A1DE35A144CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4259 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: acd1dc057f8e233565a5e6d740041c53691e781741fb64e608020881a2ac4e8f
                  • Instruction ID: 1926ceec50bff1c7c37d4a2fb14004ec9bc6650f41237a912db24a0f7ce369f2
                  • Opcode Fuzzy Hash: acd1dc057f8e233565a5e6d740041c53691e781741fb64e608020881a2ac4e8f
                  • Instruction Fuzzy Hash: 9421A530A0AA5E8FDB59DF7884662B93BA0FF69301F0505BFD41DC71A2DA346544CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4795 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0d28a54825d08b735d53b66c7a5c677b980594f945598d4b86eeed5e79b43bc1
                  • Instruction ID: c9d542607c0f6efd7b6d6bd0d7761cb6c27a9108b9a7bfba284fe2890f3986fe
                  • Opcode Fuzzy Hash: 0d28a54825d08b735d53b66c7a5c677b980594f945598d4b86eeed5e79b43bc1
                  • Instruction Fuzzy Hash: 93110871A0EA8D8FEB59DFB488761B93BA0FF19300F0905BED01DC65F2DA256540CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B20B1 Relevance: .1, Instructions: 65COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 346668a9f9bd1a773d86872781b3323218a800502a2e5820a8df215a74550ed2
                  • Instruction ID: 6342817a7978671644255dbf3e1542ef823d7938f891aa390c497cf8f00f1b5a
                  • Opcode Fuzzy Hash: 346668a9f9bd1a773d86872781b3323218a800502a2e5820a8df215a74550ed2
                  • Instruction Fuzzy Hash: 5D116A30A0968D8FDB58DF68C4A65E97FA1FF5D304F02027EE84AC3191CA34A551CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B69F5 Relevance: .1, Instructions: 64COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 488d4204d765195c98d4f79568dc255c2962eaeb0aa90a295e465cb54fe082f4
                  • Instruction ID: ac8c54a5cba61029624101924d5e49ccdffcc82f6ec1925264c21a6d7fbdc31f
                  • Opcode Fuzzy Hash: 488d4204d765195c98d4f79568dc255c2962eaeb0aa90a295e465cb54fe082f4
                  • Instruction Fuzzy Hash: 401126B0A0EA4E4FEF69DFA488B55B87BA0FF18300F0540BED41DC60A2DE25A504C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4B09 Relevance: .1, Instructions: 62COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: de42e1628de4f64a4f518bb1f463f0c3fc14e9d2018d24fc825b62683f444c7b
                  • Instruction ID: 8a0d110f557b65a7fea7dea2332a7583a0fb95ca987f98a2038d49261ce5b21c
                  • Opcode Fuzzy Hash: de42e1628de4f64a4f518bb1f463f0c3fc14e9d2018d24fc825b62683f444c7b
                  • Instruction Fuzzy Hash: 2C118E30A0A65E4FEB99EBA4886A6B97BB0FF19301F0505BED419C71A2DE3465408B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC5C0 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: fb6676c5ebd5354728b99a497aa84b04e1b40211f420108b713c11eb85601705
                  • Instruction ID: 35ff5170b39adedef7d62cfc3cfa78b2ce4c57297211f329eb65085c6710c99a
                  • Opcode Fuzzy Hash: fb6676c5ebd5354728b99a497aa84b04e1b40211f420108b713c11eb85601705
                  • Instruction Fuzzy Hash: 12116A30A0A64E8EEB5AEF64C8685B93BA0FF19304F0105BAD419C60A2DA78A644CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B7051 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: d8f8bc9bd97e7f08015051a6e0cbfbd0b6842dd2bc9a02be7ddbaef4af1f38dd
                  • Instruction ID: 12f823030479c570ce3b50b098167d675dbd136cc47e1c9f3edf40cf96c888d2
                  • Opcode Fuzzy Hash: d8f8bc9bd97e7f08015051a6e0cbfbd0b6842dd2bc9a02be7ddbaef4af1f38dd
                  • Instruction Fuzzy Hash: A911A93490D65E8FDB51EBB8C8585AE7BF0FF19300F0105B7D418C71B1DA34A2418B91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B696A Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4a798aca43004d9af9aac69354ee13e972bf26e8cd4a614445e6fb406280b18b
                  • Instruction ID: 826cf468cd89098eadf1c9b16bd53a0617cf9a5ac83c35e39aa5b01992c59f2c
                  • Opcode Fuzzy Hash: 4a798aca43004d9af9aac69354ee13e972bf26e8cd4a614445e6fb406280b18b
                  • Instruction Fuzzy Hash: 1A118670A09A5E8FEB58EF7884656BD7AE1FF58301F10057ED41DC21A5DE34A254CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B24A1 Relevance: .1, Instructions: 59COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5d884c2ea4fd46cdd63529f4bef319633559c8b4ba4dba61069403147ba7647f
                  • Instruction ID: 739ff7f277e22a70d34588d724a2c59c42a2f15c941ed714784124a98621cc57
                  • Opcode Fuzzy Hash: 5d884c2ea4fd46cdd63529f4bef319633559c8b4ba4dba61069403147ba7647f
                  • Instruction Fuzzy Hash: B011A530A1A56E5EE751EFB488585F97FE0FF1D300F0545B6D41CC70A6DA34A284CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B48BD Relevance: .1, Instructions: 58COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8d971070e59c0518946c3faf8d08e9f8aafac694990ceaac2530d92e50511d77
                  • Instruction ID: f97673871353cfee3caccd667c00e91683c4ba64c37127e4dd3e6174e953a9fe
                  • Opcode Fuzzy Hash: 8d971070e59c0518946c3faf8d08e9f8aafac694990ceaac2530d92e50511d77
                  • Instruction Fuzzy Hash: 53119030E0965E8FEB58EFA488AA6BD77F0FF18300F0405BED419C21A6DE3461418B41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8ABD15 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: bc98ecdc09e91c3f451a02c82ab03f868504114da8735b2074d18e23d95edff1
                  • Instruction ID: 3b4a81efebc4fab2d8546c39a0bbb64183f917414fdef9bd7b23f012bddb7b24
                  • Opcode Fuzzy Hash: bc98ecdc09e91c3f451a02c82ab03f868504114da8735b2074d18e23d95edff1
                  • Instruction Fuzzy Hash: 39115E30A4AA4E8FDB55EFA8C8A96FD7BF0FF19301F4105BED419C61A2DA35A650C710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B5BA9 Relevance: .1, Instructions: 57COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ace49850302e6638d0a50b490805ee242c4c3136cc52fc03cc5d3e83265ce38e
                  • Instruction ID: 0807d91b868e934d5f24621e0ebe6da7bb17b481994cdf1b8efe4b6908d47864
                  • Opcode Fuzzy Hash: ace49850302e6638d0a50b490805ee242c4c3136cc52fc03cc5d3e83265ce38e
                  • Instruction Fuzzy Hash: 54119830A0E69E4FE751EB7488795E97BF0FF19300F0505B6D458C70A6DF34A5448B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A11AD Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 311501b585617ea3fd5c03dd721a350b1664e7209b12a8b993eb57bd0481c1c3
                  • Instruction ID: fa8273d38996b51e00bd49830b7424592931f0187800bfe6071ef4018faa7fc7
                  • Opcode Fuzzy Hash: 311501b585617ea3fd5c03dd721a350b1664e7209b12a8b993eb57bd0481c1c3
                  • Instruction Fuzzy Hash: 5D11B230E0E64E4FEB65EBA4C4796B97BE0EF5A304F0104BED41AC61E1EE295640C710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B4A7D Relevance: .1, Instructions: 56COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2522a0bbd34771b3312c6d37be170b11193b219c2db329d5fb3eac7a546c4575
                  • Instruction ID: 5612cccaa9eda4ba1f4f6cbbddf156a4f0381a70bf85865e744dd983956d9ced
                  • Opcode Fuzzy Hash: 2522a0bbd34771b3312c6d37be170b11193b219c2db329d5fb3eac7a546c4575
                  • Instruction Fuzzy Hash: BD118230A0965E8FEB59EB74886A6B97BA0FF18304F0505BED429C61A6DE25A640CB41
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A34B5 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 102507011767c6544d5236b8bdfbbb7d23a45a25339eab904501a1259962a872
                  • Instruction ID: 8ade328a99f10e7b96eb7c27234c061804b9b281dd75b778472b0339b3fe7925
                  • Opcode Fuzzy Hash: 102507011767c6544d5236b8bdfbbb7d23a45a25339eab904501a1259962a872
                  • Instruction Fuzzy Hash: DC115230A0A64E8FDB55EFA8C8695BE7BF0FF19304F0105BED419C71A1DB35A5448710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B6F41 Relevance: .1, Instructions: 55COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6709c266a430fd7936878c2b49a6a00c887f7284b0773ad1d6d51594b5c91b55
                  • Instruction ID: bcdb6b7255f065b7de2d223b3132345927be4e83454a9fab43423fae078617be
                  • Opcode Fuzzy Hash: 6709c266a430fd7936878c2b49a6a00c887f7284b0773ad1d6d51594b5c91b55
                  • Instruction Fuzzy Hash: 8B015670E0A55E8FE761EBB888695ADBBF0FF19300F0545B6D41CC71A6EB34E6408B81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A2E21 Relevance: .1, Instructions: 53COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: af689d1228311cdadc108794a4e70d3826ce27ae924fdd38a4982ae4d06cff99
                  • Instruction ID: 010efc813eb78abc72d87bcd863292d2efdbdbde4eb9832b21c656bf2c7a0257
                  • Opcode Fuzzy Hash: af689d1228311cdadc108794a4e70d3826ce27ae924fdd38a4982ae4d06cff99
                  • Instruction Fuzzy Hash: 09017130E1A64E4FE761AFA489695A97BE0FF1A300F0245B6D418C60A6EA34E6908611
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AC0E9 Relevance: .1, Instructions: 51COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 485e7f8e9cbe7f9439ea28ab31f79b79c6da3a76d270a5d079f7ff91280aca1d
                  • Instruction ID: ca67992b5fe5acd242218ed7256b78c7b7fecbffb9c7f291d9910c4453b5ed03
                  • Opcode Fuzzy Hash: 485e7f8e9cbe7f9439ea28ab31f79b79c6da3a76d270a5d079f7ff91280aca1d
                  • Instruction Fuzzy Hash: 7411CE30A0A68E8FDB59DF64C8691B93FE1FF1D300F5200BED419C61A2DA35A654CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A05D8 Relevance: .0, Instructions: 50COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2abf4c1ef368e4c5f32852ac12d855c84f9dcbb8019e24396d0c3a97a6a83013
                  • Instruction ID: 4499aa67f83fe41874c307a3719e1e954e22892f83d939cf523929425281bb7e
                  • Opcode Fuzzy Hash: 2abf4c1ef368e4c5f32852ac12d855c84f9dcbb8019e24396d0c3a97a6a83013
                  • Instruction Fuzzy Hash: E8019E30A0A50E8FEB68EF64C0646BAB7A1FF5A304F11007ED40EC31A4CE36A690CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AB8CA Relevance: .0, Instructions: 49COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 946b5b9b755f6ecb6343e16bccd1ed9d1d23741f2df132f6608ccaae759b8e49
                  • Instruction ID: 87d94f628972e06735923738e75fc1e24558869f46533acd429bd1f1b99dc15b
                  • Opcode Fuzzy Hash: 946b5b9b755f6ecb6343e16bccd1ed9d1d23741f2df132f6608ccaae759b8e49
                  • Instruction Fuzzy Hash: B6018030A0AA0E8EEB94EF68C4A82BD77E0FF1C304F01057ED41EC21A1DE75A640C741
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A27FD Relevance: .0, Instructions: 47COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3025198d06d7aded392dd27972679971d57f978fb739df6ada2c09b74c55d8eb
                  • Instruction ID: 38e3f3e31b32390420f364cc704f21b265cbe1dbe99e2c0856ddba22494d9d9a
                  • Opcode Fuzzy Hash: 3025198d06d7aded392dd27972679971d57f978fb739df6ada2c09b74c55d8eb
                  • Instruction Fuzzy Hash: 9B01D430A4A64E4FE761EFA888995B97BE0FF1D300F0245B6E40CC60A6EE38E5448710
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B0A20 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 037d8f27725aa6134d8a4dfb89935711050ec74bec9d8807ab7d29e4f59a8c45
                  • Instruction ID: 627a78e45a4bc3bda09f4e707b75e9b9c02e2d2809330fa23d7433abfe196c0c
                  • Opcode Fuzzy Hash: 037d8f27725aa6134d8a4dfb89935711050ec74bec9d8807ab7d29e4f59a8c45
                  • Instruction Fuzzy Hash: 7E011A34A1591E8EEB94EFA4C4696BE77E0FF18305F11087AD41ED21A5DE35A650CB40
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8AA6D9 Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2e729276d1e346d283e7f9b599914a5cd706945c2b717b0481f041c8f9bb3b62
                  • Instruction ID: 89f22b9391f8dc8d4f933c4fd52c9427fd370997db6ccc388f81e6bf876634fb
                  • Opcode Fuzzy Hash: 2e729276d1e346d283e7f9b599914a5cd706945c2b717b0481f041c8f9bb3b62
                  • Instruction Fuzzy Hash: 0301B530A4E64D9FD762AB7488685A97BF0EF09300F0649B7D448C70B2EA38A5448711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8B77DD Relevance: .0, Instructions: 46COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B2000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8b2000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 17d7e0299c979c4173b8ce36ee385f1cc38c67215a9253003aa882ec9ada7e77
                  • Instruction ID: 37c9297f834faa6e1e7ccce87e75a1144b553932651dafb11974f9490ff3b064
                  • Opcode Fuzzy Hash: 17d7e0299c979c4173b8ce36ee385f1cc38c67215a9253003aa882ec9ada7e77
                  • Instruction Fuzzy Hash: 39019234A4A65E4FDB5AEB74C8655B93BA0FF09304F0104BED01DC74E2DA25A640CB81
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A2E99 Relevance: .0, Instructions: 44COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: cbb46e048e9b15512ee5cf1e13925080b50033c6226ed949db92fb006be5c076
                  • Instruction ID: a118de390d430fbcde87b83c52cde4613dad8582bfd2a869d088cfa99a2d4168
                  • Opcode Fuzzy Hash: cbb46e048e9b15512ee5cf1e13925080b50033c6226ed949db92fb006be5c076
                  • Instruction Fuzzy Hash: 7C018430A0E64D4FD762EBB489595A97BE0EF4A300F0645B7D40CCB0B7DA38A6948721
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1BDD Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e3d1ae342a83fddf85d409cba808018c40db26b630125665acdad1ee9c85eaaf
                  • Instruction ID: 643ea21a3789acc4c1125d2e574c4479dd81ef2bc9aa2c19591954ef22fb8b13
                  • Opcode Fuzzy Hash: e3d1ae342a83fddf85d409cba808018c40db26b630125665acdad1ee9c85eaaf
                  • Instruction Fuzzy Hash: A801A230A0E68E8FDB65EF64C8655B97BA1FF5A300F45017ED808C61A2DB759690C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0610 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2f0a7c0fb03786efeb51d5460262337013a7766539b42b03d1754f29c1616e47
                  • Instruction ID: c474b277964dd80b0bb486bd36dec8e0bd5580a27f84563216cf2d03cf08ea24
                  • Opcode Fuzzy Hash: 2f0a7c0fb03786efeb51d5460262337013a7766539b42b03d1754f29c1616e47
                  • Instruction Fuzzy Hash: 46016230A1550E8EDB68EFA4C4686B973A0FF18305F51087ED41EC21E5DE35B650CA10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0608 Relevance: .0, Instructions: 42COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8d684504ecaec64f47054515c4d5abbadf7f6b93dd9b8b9535b68abfefc99d38
                  • Instruction ID: a4b1b2879c4dee8bca2ddb8650c4b3e721dc9d5dbad6ed83fc360e9d09ed3538
                  • Opcode Fuzzy Hash: 8d684504ecaec64f47054515c4d5abbadf7f6b93dd9b8b9535b68abfefc99d38
                  • Instruction Fuzzy Hash: BC018130A1550ECAEB68EFA4C5686B973A0FF1C304F51087EE41EC61E5DE35B650CA10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A05D0 Relevance: .0, Instructions: 39COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 0acc2a38a9f4bc55b8d37bbd578b8aec40ba526228fe741d226889711c959715
                  • Instruction ID: 54721f135a3ba2ef84f85573fc451abf4b816d3509da5e349dfe23f774716508
                  • Opcode Fuzzy Hash: 0acc2a38a9f4bc55b8d37bbd578b8aec40ba526228fe741d226889711c959715
                  • Instruction Fuzzy Hash: 21F0C830A0A50E8FEB64EF6494255FA77A0EF0A308F01007AE80DC30E1DE75A650C740
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A11C0 Relevance: .0, Instructions: 38COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 49258d9587c7d56f02a697ff4907ef514c4dc0d6c58a59f17b1ea214103af35c
                  • Instruction ID: 0d78a35850abef11b8e2b2fc910e85b2be1c97b66acf2b7b8932fd4a0d2894fd
                  • Opcode Fuzzy Hash: 49258d9587c7d56f02a697ff4907ef514c4dc0d6c58a59f17b1ea214103af35c
                  • Instruction Fuzzy Hash: 1DF0C230E1A65F4AFBA4EBE498792F977E4FF5A304F00147AE42EC20E1EF285654C650
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A278D Relevance: .0, Instructions: 34COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6d68daee40d4b0aa9feec762fda9762a6b7df11f91ef99b7f4f089543aa6ce6f
                  • Instruction ID: 408207c76a1cb2d53dfde7e9b8363e4c32c125f467d7017e30c0cc420df01e98
                  • Opcode Fuzzy Hash: 6d68daee40d4b0aa9feec762fda9762a6b7df11f91ef99b7f4f089543aa6ce6f
                  • Instruction Fuzzy Hash: 69F0F630A0E78ECFDB699F6488241A93BA0FF09600F0105BED809C60E2EB38A640C711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A2719 Relevance: .0, Instructions: 33COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 7347d05924421bf7d56123789fafeffb70827bb64fa9025f2eac9c5c7d8e2835
                  • Instruction ID: ce4389100f030cf7b6ca40728ee2da195e3125058edb33662fc8308fe75ff02c
                  • Opcode Fuzzy Hash: 7347d05924421bf7d56123789fafeffb70827bb64fa9025f2eac9c5c7d8e2835
                  • Instruction Fuzzy Hash: FCF0963050E38D8FDB699F6488642E93B70FF06304F4515FAE819C61E6DB38A654C751
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A1710 Relevance: .0, Instructions: 25COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction ID: b9ac0fc198507bde863b3500a176d862d3809c50e884dc35ce3aae6bd9f3babe
                  • Opcode Fuzzy Hash: 8e326a7859796f2f06554e02ef0215a1b0a6375c4fcc80102119e97bc4414c77
                  • Instruction Fuzzy Hash: 62E0E520F0A94A4AEB747358849557471D19B4A314FBA8675F01CC61F1DB2CDD81C711
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00007FFD9B8A0FB9 Relevance: .0, Instructions: 14COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8a0000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 3826d7b4aac151dc33ea958044240470da9d0c37198d1c17e7b74b7133fed37d
                  • Instruction ID: 18e1a81b2d5e4b8571a6641df6467aa735205ff6d365c1fbcd9996c217d09dcd
                  • Opcode Fuzzy Hash: 3826d7b4aac151dc33ea958044240470da9d0c37198d1c17e7b74b7133fed37d
                  • Instruction Fuzzy Hash: 10E0EC20E1641D4AEB98EB54DC61FADA6B1EF48304F5041B5D00DA3296DE346E858B54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 00007FFD9B8AED53 Relevance: 5.1, Strings: 4, Instructions: 93COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.1860887328.00007FFD9B8AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8AA000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_20_2_7ffd9b8aa000_BfsBBmsxHEOpauZphVFNsX.jbxd
                  Similarity
                  • API ID:
                  • String ID: "$9$]$f
                  • API String ID: 0-3947874909
                  • Opcode ID: ede844ceb61007281be67a51b406415fcb6c9d6fd7db5500bb4a1450130cea30
                  • Instruction ID: 3c3baeb396ae52f74a7df74a801409d31ad4852c19f9150a9b12ba6e6e84b55b
                  • Opcode Fuzzy Hash: ede844ceb61007281be67a51b406415fcb6c9d6fd7db5500bb4a1450130cea30
                  • Instruction Fuzzy Hash: AA41C670E0962E8FEBA8DF94C8A47B9B6B1AB18301F1145FAD40DA3690DB745EC1CF10
                  Uniqueness

                  Uniqueness Score: -1.00%